fix: cap job token authority at workspace admin

A job token ($WM_TOKEN) derives its identity from an app/flow/schedule
on_behalf_of, which a wm_deployers member controls. Ensure such a token can
never act above workspace admin, regardless of the identity it runs as.

- ApiAuthed gains token_is_job (set from the JWT job_id claim).
- require_super_admin / is_super_admin / require_devops_role now take &ApiAuthed
  and deny job tokens for superadmin/devops-gated endpoints (one choke point
  instead of a per-route denylist); require_super_admin_email kept for
  internal, non-request callers.
- Inline is_super_admin_email(authed.email) capability gates migrated to the
  cap-aware is_super_admin(db, &authed).
- Defense in depth: validate_on_behalf_of rejects reserved internal identities
  and mismatched-superadmin emails when persisting an app/flow/script/schedule/
  trigger on_behalf_of; app execution refuses reserved-identity policies.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/windmill-api-scripts/src/scripts.rs

@@ -978,6 +978,20 @@ async fn create_script_internal<'c>(
             }
         }
     }
+    // Reject a forged superadmin run identity in a preserved value (otherwise
+    // `resolve_on_behalf_of_email` stores the deployer's own email below). A
+    // script stores no permissioned_as, so this is the sentinel guard.
+    if ns.preserve_on_behalf_of.unwrap_or(false)
+        && windmill_common::can_preserve_on_behalf_of(&authed)
+    {
+        windmill_common::auth::validate_on_behalf_of(
+            &db,
+            &w_id,
+            None,
+            ns.on_behalf_of_email.as_deref(),
+        )
+        .await?;
+    }
     if sqlx::query_scalar!(
         "SELECT 1 FROM script WHERE hash = $1 AND workspace_id = $2",
         hash.0,