step 1/4: the permission engine is called permissions, not capabilities

The word meant four different things in this repo, not the three the offscale
doc records:

  1. the permission registry              → RENAMED here
  2. $OFFICER_ROOT/capabilities/ items    → kept; this is what capabilities are
  3. sidecar routing keys                 → step 3, becoming `handles`
  4. Lightning wallet features            → kept; a domain term, and on the wire
                                            to the mobile apps

The fourth was not in the doc and a global find-and-replace would have broken
the mobile wallet, which reads `{ kind, capabilities: Capability[] }` from the
wallet sidecar. So this renamed against an explicit file allowlist rather than
by sweeping the tree, and `CapabilityPage.tsx` — the UI for the item store, and
correctly named already — was left alone.

Moved: servers/capabilities/ → servers/permissions/, capability-gate.ts →
permission-gate.ts, users/capabilities-routes.ts → permissions-routes.ts,
hooks/useCapabilities.ts → usePermissions.ts. Identifiers follow.

Three breaks the typechecker could not see, all found by exercising it live.

The route paths moved with the prose sweep, so the server served
/user/permissions while the frontend still called /user/capabilities. A 404 on
every page load, and tsgo clean throughout.

The response FIELD moved too. `client.get<SelfPermissions>()` is an unchecked
cast, so `data.capabilities` became `undefined` at runtime with no compile
error — `can()` would have answered "no" to everything and the dock would have
emptied itself.

And the grants list was passed straight out of the database, so it arrived as
`{ role, capability, level }` while the screen read `grant.permission`. Every
role would have rendered as holding nothing. It is now mapped in the route:
the wire says `permission`, the column still says `capability`, and step 2
therefore changes nothing any client can see.

The stale react-query keys were the quiet one: two files still invalidated
['self-capabilities'] after the hook moved to ['self-permissions'], so
installing a plugin would have silently stopped refreshing the dock.

The database is untouched — `role_capabilities` and its `capability` column are
step 2, and the two call sites that cross that boundary say so in a comment.
Round-tripped the 9 live grants through the admin endpoint to prove the PUT
contract survived: 9 before, 9 after, Member's three intact.

Also reverted prettier churn on five landing-page files that a broad --write
picked up. Second time today; the lesson is not sticking.

tsgo clean. 797 tests, 787 pass, same 7 pre-existing failures — two of which
now read "path → permission" rather than "path → capability".

src/apps/officer-web/Screens/Dashboard/Layout/DashboardLayout.tsx

@@ -1,7 +1,7 @@
 import { useMemo, useRef } from 'react';
 import { useLocation } from 'react-router';
 import { useDock, usePanelFullscreen } from 'officerdev';
-import { useCapabilities } from 'hooks/useCapabilities';
+import { usePermissions } from 'hooks/usePermissions';
 import { ErrorBoundary } from '@/components/ErrorBoundary';
 import { ScreenErrorFallback } from './ScreenErrorFallback';
 import { Background } from './Background';
@@ -15,7 +15,7 @@ type DashboardLayoutProps = {
   children?: React.ReactNode;
 };
 export function DashboardLayout({ children }: DashboardLayoutProps) {
-  const { canVisit, plugins } = useCapabilities();
+  const { canVisit, plugins } = usePermissions();
   // Filtered BEFORE useDock, so a member's saved dock order cannot resurrect an icon their role no longer
   // reaches, and so the pinned-item defaults fall back to something they can actually open. Cosmetic
   // either way — every one of these routes is refused server-side too — but an app that offers a door it

src/apps/officer-web/Screens/Dashboard/Layout/Dock.tsx

@@ -2,7 +2,7 @@ import { useEffect, useRef, useState } from 'react';
 import { NavLink } from 'react-router';
 import type { LucideIcon } from 'lucide-react';
 import { resolveIcon } from 'officerdev';
-import type { PluginManifest } from 'hooks/useCapabilities';
+import type { PluginManifest } from 'hooks/usePermissions';
 
 export type DockItem = {
   label: string;

src/apps/officer-web/Screens/Dashboard/Layout/Header/JobsIndicator.tsx

@@ -2,7 +2,7 @@ import { useState, useEffect } from 'react';
 import { Link } from 'react-router';
 import { Loader2, ListOrdered } from 'lucide-react';
 import { useClient } from 'hooks/useClient';
-import { useCapabilities } from 'hooks/useCapabilities';
+import { usePermissions } from 'hooks/usePermissions';
 
 type Counts = { running: number; runningJobId: string | null; queued: number };
 
@@ -14,7 +14,7 @@ type Counts = { running: number; runningJobId: string | null; queued: number };
 // links to a screen they cannot open. Neither is a security problem; both are the app lying about what it is.
 export const JobsIndicator = () => {
   const client = useClient();
-  const { can } = useCapabilities();
+  const { can } = usePermissions();
   const allowed = can('tasks');
   const [counts, setCounts] = useState<Counts>({ running: 0, runningJobId: null, queued: 0 });
 

src/apps/officer-web/Screens/Dashboard/Layout/Rescan/RescanButton.tsx

@@ -3,7 +3,7 @@ import { RotateCw } from 'lucide-react';
 import { useQueryClient } from '@tanstack/react-query';
 import { toast } from 'sonner';
 import { useClient } from 'hooks/useClient';
-import { useCapabilities } from 'hooks/useCapabilities';
+import { usePermissions } from 'hooks/usePermissions';
 
 type RescanResponse = { ok: boolean; counts: Record<string, number> };
 
@@ -14,7 +14,7 @@ const ITEM_QUERY_KEYS = ['tasks', 'task-categories', 'skills', 'tools', 'process
 export function RescanButton() {
   const client = useClient();
   const qc = useQueryClient();
-  const { can } = useCapabilities();
+  const { can } = usePermissions();
   const [loading, setLoading] = useState(false);
 
   // `POST /api/rescan` belongs to the `items` capability — skills, tools, agents and processes on the

src/apps/officer-web/Screens/Dashboard/Layout/RouteGate.tsx

@@ -1,5 +1,5 @@
 import { Navigate, useLocation } from 'react-router';
-import { useCapabilities } from 'hooks/useCapabilities';
+import { usePermissions } from 'hooks/usePermissions';
 
 // A screen exists only if this server has the thing behind it and this account may reach it. Otherwise the
 // path is treated exactly as an unknown one: redirect home, same as App.tsx's `path="*"`.
@@ -27,7 +27,7 @@ import { useCapabilities } from 'hooks/useCapabilities';
 
 export function RouteGate({ children }: { children?: React.ReactNode }) {
   const { pathname } = useLocation();
-  const { denialReason } = useCapabilities();
+  const { denialReason } = usePermissions();
 
   // `replace`, so Back does not bounce between the denied path and home.
   if (denialReason(pathname)) return <Navigate to="/" replace />;