feat!: respect access control by default in Local API

[nathanlentz]

What?

This changes the Local API to respect access control by default. overrideAccess now defaults to false consistently across collection, global, auth, and jobs operations.

This is a breaking change. A Local API call without overrideAccess will no longer automatically bypass access control.

Before:

await payload.find({
  collection: 'posts',
})
// Access control was bypassed.

After:

await payload.find({
  collection: 'posts',
})
// Access control is enforced for an anonymous request.

To intentionally keep the previous behavior:

await payload.find({
  collection: 'posts',
  overrideAccess: true,
})

To run the operation as a user:

await payload.find({
  collection: 'posts',
  user,
})

The PR also adds a codemod that preserves existing application behavior by adding overrideAccess: true to Local API calls it can identify safely:

npx @payloadcms/codemod . --transform add-override-access-true

The codemod keeps existing explicit values and reports calls that need manual review.

Why?

Passing a user to a Local API operation should cause that user's access rules to be respected unless the caller explicitly chooses to bypass them. The previous default made user-scoped calls easy to get wrong and was especially confusing because the supplied user could be ignored for access checks.

How?

• Unifies the default as overrideAccess: false across Local API operations.
• Keeps trusted internal framework operations explicit with overrideAccess: true.
• Adds regression coverage for anonymous, user-scoped, and explicitly overridden calls.
• Adds and tests the add-override-access-true migration codemod.

Stack

1. Core breaking change and codemod: this PR
2. First-party plugins: #17687
3. Templates: #17688

Documentation will follow separately after the enterprise plugins are updated.

Related: PYLD-2327