Update documentation: Remove NoActor bypass references

docs/roles-and-permissions-implementation-plan.md

@@ -542,7 +542,7 @@ Following the same pattern as Member resource:
 1. ✅ Open `lib/accounts/user.ex`
 2. ✅ Add `policies` block
 3. ✅ Add AshAuthentication bypass (registration/login without actor)
-4. ✅ Add NoActor bypass (test environment only)
+4. ✅ ~~Add NoActor bypass (test environment only)~~ **REMOVED** - NoActor bypass was removed to prevent masking authorization bugs. All tests now use `system_actor`.
 5. ✅ Add bypass for READ: Allow user to always read their own account
    ```elixir
    bypass action_type(:read) do
@@ -556,10 +556,11 @@ Following the same pattern as Member resource:
 
 **Policy Order:**
 1. ✅ AshAuthentication bypass (registration/login)
-2. ✅ NoActor bypass (test environment)
-3. ✅ Bypass: User can READ own account (id == actor.id)
-4. ✅ HasPermission: General permission check (UPDATE uses scope :own, admin uses scope :all)
-5. ✅ Default: Ash implicitly forbids (fail-closed)
+2. ✅ Bypass: User can READ own account (id == actor.id)
+3. ✅ HasPermission: General permission check (UPDATE uses scope :own, admin uses scope :all)
+4. ✅ Default: Ash implicitly forbids (fail-closed)
+
+**Note:** NoActor bypass was removed. All tests now use `system_actor` for authorization.
 
 **Why Bypass for READ but not UPDATE?**
 
@@ -574,7 +575,7 @@ This ensures `scope :own` in PermissionSets is actually used (not redundant).
 - ✅ User can always update own credentials (via HasPermission with scope :own)
 - ✅ Only admin can read/update other users (scope :all)
 - ✅ Only admin can destroy users (scope :all)
-- ✅ Policy order is correct (AshAuth → NoActor → Bypass READ → HasPermission)
+- ✅ Policy order is correct (AshAuth → Bypass READ → HasPermission)
 - ✅ Actor preloads :role relationship
 - ✅ All tests pass (30/31 pass, 1 skipped)
 
@@ -584,7 +585,7 @@ This ensures `scope :own` in PermissionSets is actually used (not redundant).
 - ✅ 31 tests total: 30 passing, 1 skipped (AshAuthentication edge case)
 - ✅ Tests for all 4 permission sets: own_data, read_only, normal_user, admin
 - ✅ Tests for AshAuthentication bypass (registration/login)
-- ✅ Tests for NoActor bypass (test environment)
+- ✅ Tests use system_actor for authorization (NoActor bypass removed)
 - ✅ Tests verify scope :own is used for UPDATE (not redundant)
 
 ---