refactor(webapp): depend on the host RBAC controller surface

The API key policy methods are optional on the plugin-facing controller
contract, so `Pick` over it yields optional members that these call sites
would have to guard. Both already receive the LazyController singleton,
which has substituted its fail-closed defaults, so point them at
HostRbacController and keep the call sites guard-free.

Author: carderne

apps/webapp/app/models/api-key.server.ts

@@ -1,5 +1,9 @@
 import type { PrismaClient, RuntimeEnvironment } from "@trigger.dev/database";
-import type { RoleBaseAccessController } from "@trigger.dev/rbac";
+// HostRbacController, not RoleBaseAccessController: the policy methods are
+// optional on the plugin-facing contract, and `rbac` (LazyController) has
+// already substituted the fail-closed defaults for any an installed plugin
+// omits. Depending on the host surface keeps this call site guard-free.
+import type { HostRbacController } from "@trigger.dev/rbac";
 import { trail } from "agentcrumbs"; // @crumbs
 import { customAlphabet } from "nanoid";
 import { prisma } from "~/db.server";
@@ -128,7 +132,7 @@ export async function createEnvironmentApiKey(
     rbacController = rbac,
   }: {
     prismaClient?: Pick<PrismaClient, "runtimeEnvironment" | "taskIdentifier" | "apiKey">;
-    rbacController?: Pick<RoleBaseAccessController, "prepareApiKeyPolicy">;
+    rbacController?: Pick<HostRbacController, "prepareApiKeyPolicy">;
   } = {}
 ) {
   const environment = await prismaClient.runtimeEnvironment.findFirst({

apps/webapp/app/presenters/v3/ApiKeysPresenter.server.ts

@@ -1,15 +1,16 @@
 import { type RuntimeEnvironment } from "@trigger.dev/database";
-import { scopesGrantFullAccess, type RoleBaseAccessController } from "@trigger.dev/rbac";
+// HostRbacController, not RoleBaseAccessController: the policy methods are
+// optional on the plugin-facing contract, and `rbac` (LazyController) has
+// already substituted the fail-closed defaults for any an installed plugin
+// omits. Depending on the host surface keeps these call sites guard-free.
+import { scopesGrantFullAccess, type HostRbacController } from "@trigger.dev/rbac";
 import { type PrismaReplicaClient, $replica } from "~/db.server";
 import { type Project } from "~/models/project.server";
 import { type User } from "~/models/user.server";
 import { rbac } from "~/services/rbac.server";
 import { obfuscateApiKey } from "~/utils/apiKeys";
 
-type ApiKeyPolicyPresenter = Pick<
-  RoleBaseAccessController,
-  "apiKeyPresets" | "describeApiKeyPolicy"
->;
+type ApiKeyPolicyPresenter = Pick<HostRbacController, "apiKeyPresets" | "describeApiKeyPolicy">;
 
 export class ApiKeysPresenter {
   // Read-only presenter for a dashboard page — all queries below are reads, so