#530 [API/Perf] Multiple database connections for single permission check

**File:** api/middleware/rbac.py:660-680 **Problem:** Permission check and role retrieval use separate database connections. Two connections for what could be one. **Fix:** Combine into single connection: ```python def _check_permission_with_roles() -> tuple[bool, list]: with db.get_db_connection() as conn: has_perm = check_user_permission(conn, tenant_id, user_email, permission) roles = get_user_roles(conn, tenant_id, user_email) if not has_perm else [] return has_perm, roles ``` **Impact:** 50% reduction in DB connections on permission errors.