fix: @thumbor-auth prefers storage conn over psycopg pool (related to #8)

[jensens]

Summary

• Follow-up to fix: drop per-image SQL from _needs_auth_url (closes #8) #9 targeting the other per-image SQL site in this repo: ThumborAuthService in restapi.py.
• Prefers get_storage_connection(self.context) — the ZODB storage's PG connection already held for the request — over pool.getconn(), eliminating pool contention for the @thumbor-auth code path.
• SQL query and response semantics are unchanged — this is strictly a connection-acquisition change.

Why minimal (not a full rewrite)

Unlike _needs_auth_url (closed by #9), this service answers a multi-principal question:

Does the user's principal set (['Anonymous', 'user:alice', 'Manager', …]) overlap with this object's allowed_roles?

rolesForPermissionOn alone is not sufficient here — allowed_roles also carries user:<id> tokens from local-role grants, which rolesForPermissionOn doesn't return. A full Zope-native rewrite (load the object, ask checkPermission("View", obj) against the current security manager) is a larger change, trades one PG round-trip for one ZODB load, and changes semantics (live vs. cached). Worth considering separately, but out of scope for the pool-saturation fix.

This PR is the smallest change that stops @thumbor-auth from contending on the psycopg pool. It:

• Kills pool.getconn() from this hot path (the origin of the PoolTimeout traceback in Short-circuit _needs_auth_url on anonymous requests (skip DB call) #8).
• Matches the pattern plone-pgcatalog itself uses in _get_pg_read_connection — storage-conn first, pool as fallback.
• Preserves the fallback for contexts without a live ZODB storage (tests, scripts, non-Zope).

Behaviour matrix (unchanged from before)

Scenario	Status	Body
Principals overlap allowed_roles	200	{}
No overlap	401	{"error": "Unauthorized"}
zoid missing / non-hex	400	{"error": ...}
zoid not in object_state	404	{"error": "Not found"}
PG error	503	{"error": "Service unavailable"}

Test plan

• New test: test_prefers_storage_connection_over_pool — verifies get_storage_connection is called, get_pool / get_request_connection are not.
• New test: test_falls_back_to_pool_when_no_storage_connection — verifies pool path still works when no storage conn is available.
• Updated _patch_dependencies helper and test_db_error_returns_503 to patch the new import.
• Full suite: 150/150 passing.

🤖 Generated with Claude Code