ListDomains returns metadata without authorization checks

Description

An unauthenticated user can enumerate domains and view metadata. The ListDomains is currently not protected by backend authorization, so ./cadence admin domain list can succeed without a JWT even when auth is enabled.

Steps to Reproduce / How to Trigger

1. Run Cadence with OAuth authorization enabled.
2. Create domains with authorization-related metadata, for example:
   • domain-readers with READ_GROUPS=readers
   • domain-writers with WRITE_GROUPS=writers
3. Without passing any JWT, run:

./cadence admin domain list

Expected Behavior

1. unauthenticated callers are not able to enumerate domains.
2. unauthorized callers are not able to enumerate domains they do not have access to.
3. admins are able to enumerate entire list.

Proposed Fix

For now, the focus could be on filtering domains based on the permissions stored in the domain metadata (READ_GROUPS / WRITE_GROUPS). Once this issue is addressed, the behavior can be expanded or refined if needed.

Related context

This came up while reviewing frontend work to hide domains based on read/write access in cadence-web. That approach should not be treated as sufficient until backend semantics for ListDomains are defined and enforced (https://github.com/cadence-workflow/cadence-web/pull/1108#discussion_r2891118025).

Environment

• Cadence server version: 1.4.0