feat: re-check central RTC authorization right before every write (GET /v1/agents/me/authorizations), human labels on the cClassTrib control page, final corpus/scale evidence; 1.2.1

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/tests/test_rtc_security.py

@@ -85,3 +85,15 @@ def test_audit_rows_never_carry_credentials_or_tokens():
         blob = repr([getattr(row, c.name) for c in RtcWriteAudit.__table__.columns])
         assert "password" not in blob.lower() and "'t'" not in blob and "Bearer" not in blob
         assert not any("pass" in c.name or "token" in c.name or "secret" in c.name for c in RtcWriteAudit.__table__.columns)
+
+
+def test_agent_can_reread_only_its_own_current_authorization_and_it_follows_the_operator():
+    client, engine = _client()
+    hb(client)
+    assert client.get("/v1/agents/me/authorizations").status_code in (401, 403)                     # requires the Agent credential
+    assert client.get("/v1/agents/me/authorizations", headers=H).json()["rtc_write_mode"] == "DISABLED"
+    with Session(engine) as s:
+        s.scalars(select(Installation)).one().rtc_write_mode = "ENABLED"
+        s.commit()
+    body = client.get("/v1/agents/me/authorizations", headers=H).json()
+    assert body["rtc_write_mode"] == "ENABLED" and set(body) == {"rtc_write_mode", "rtc_approved_codes", "rtc_rollbacks"}