feat: add DA_OPS_IMS_BOT_EMAIL escape hatch for bot write access

[auniverseaway]

Summary

Adds DA_OPS_IMS_BOT_EMAIL, a Worker env variable that grants its bearer the same full-write ops escape hatch as the existing DA_OPS_IMS_ORG (introduced in #233), but matched against the user's IMS profile email instead of an IMS org identifier. Use case: scoping ops write access to one bot identity rather than every member of an IMS org.

Changes

• src/utils/auth.js — inside getAclCtx, mirror the existing if (env.DA_OPS_IMS_ORG) block with a structurally identical block keyed on env.DA_OPS_IMS_BOT_EMAIL. Injects two ACL rows (write on CONFIG, write on / + **).
• src/index.d.ts — add DA_OPS_IMS_BOT_EMAIL: string; to the Env interface.
• test/utils/auth.test.js — add 'test DA_OPS_IMS_BOT_EMAIL permissions' mirroring the existing DA_OPS_IMS_ORG test, plus a negative assertion that a non-matching email is denied.

Behavior

Both env vars are independent and additive. Either, both, or neither may be set.

DA_OPS_IMS_ORG	DA_OPS_IMS_BOT_EMAIL	Result
no	no	unchanged from today
yes	no	unchanged from today (existing escape hatch)
no	yes	users with matching email get full write
yes	yes	union — users matching either get full write

Matching is case-insensitive: getIdents lowercases user.email and the rule-build loop lowercases each groups token, so no normalization is needed at injection.

Notes for operators

The value must be a single email address. Comma-separated multi-value is not validated and would silently grant access to multiple identities through the downstream groups.split(',') parser — out of scope for this change; if multi-bot is needed later, add it explicitly.

Test Plan

• npm test — 391 passing, 0 failing
• npm run lint — clean
• New test fails before the implementation commit (TDD red), passes after (green)
• Existing DA_OPS_IMS_ORG test still passes (no regression on the precedent)

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!