fix(auth): check system:user:list against system resource in resource_users

The HACK block in resource_users() was checking the system:user:list
privilege against the requested resource_id rather than the system
resource. This made the sysadmin branch a dead leg: sysadmins hold
system:user:list on the system resource, not on individual data resources.

Fix: pass system_resource(conn).resource_id for the system-level check.
Also restructure to early-return on auth failure (cleaner control flow).

Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

0 files changed, 0 insertions, 0 deletions