step 1/4: the permission engine is called permissions, not capabilities

The word meant four different things in this repo, not the three the offscale
doc records:

  1. the permission registry              → RENAMED here
  2. $OFFICER_ROOT/capabilities/ items    → kept; this is what capabilities are
  3. sidecar routing keys                 → step 3, becoming `handles`
  4. Lightning wallet features            → kept; a domain term, and on the wire
                                            to the mobile apps

The fourth was not in the doc and a global find-and-replace would have broken
the mobile wallet, which reads `{ kind, capabilities: Capability[] }` from the
wallet sidecar. So this renamed against an explicit file allowlist rather than
by sweeping the tree, and `CapabilityPage.tsx` — the UI for the item store, and
correctly named already — was left alone.

Moved: servers/capabilities/ → servers/permissions/, capability-gate.ts →
permission-gate.ts, users/capabilities-routes.ts → permissions-routes.ts,
hooks/useCapabilities.ts → usePermissions.ts. Identifiers follow.

Three breaks the typechecker could not see, all found by exercising it live.

The route paths moved with the prose sweep, so the server served
/user/permissions while the frontend still called /user/capabilities. A 404 on
every page load, and tsgo clean throughout.

The response FIELD moved too. `client.get<SelfPermissions>()` is an unchecked
cast, so `data.capabilities` became `undefined` at runtime with no compile
error — `can()` would have answered "no" to everything and the dock would have
emptied itself.

And the grants list was passed straight out of the database, so it arrived as
`{ role, capability, level }` while the screen read `grant.permission`. Every
role would have rendered as holding nothing. It is now mapped in the route:
the wire says `permission`, the column still says `capability`, and step 2
therefore changes nothing any client can see.

The stale react-query keys were the quiet one: two files still invalidated
['self-capabilities'] after the hook moved to ['self-permissions'], so
installing a plugin would have silently stopped refreshing the dock.

The database is untouched — `role_capabilities` and its `capability` column are
step 2, and the two call sites that cross that boundary say so in a comment.
Round-tripped the 9 live grants through the admin endpoint to prove the PUT
contract survived: 9 before, 9 after, Member's three intact.

Also reverted prettier churn on five landing-page files that a broad --write
picked up. Second time today; the lesson is not sticking.

tsgo clean. 797 tests, 787 pass, same 7 pre-existing failures — two of which
now read "path → permission" rather than "path → capability".

src/servers/_middlewares/index.ts

@@ -1,7 +1,7 @@
 export * from './body-parser';
 export * from './user-middleware';
 export * from './origin-middleware';
-export * from './capability-gate';
+export * from './permission-gate';
 export * from './rate-limiter';
 export * from './known-users';
 export * from './auth-audit';

src/servers/_middlewares/permission-gate.ts

@@ -2,8 +2,8 @@ import type { MiddlewareHandler } from 'hono';
 import * as errors from '../custom-errors';
 import { resolveAuthToken } from '../auth-token';
 import { isSuperAdmin } from '../super-admin';
-import { isApiRequestAllowed } from '../capabilities/authorize';
-import { isExemptApiPath } from '../capabilities/totality';
+import { isApiRequestAllowed } from '../permissions/authorize';
+import { isExemptApiPath } from '../permissions/totality';
 
 // The global authorization gate: a valid NON-owner token may reach only what its ROLE has been granted.
 //
@@ -29,7 +29,7 @@ import { isExemptApiPath } from '../capabilities/totality';
 // This half was deliberately NOT under that flag, because it is account-based rather than origin-based.
 // Its old comment called it "the airtight half", and separating the two is why the name changed: nothing
 // in here looks at an Origin header any more.
-export const capabilityGateMiddleware: MiddlewareHandler = async function (ctx, next) {
+export const permissionGateMiddleware: MiddlewareHandler = async function (ctx, next) {
   const path = ctx.req.path;
 
   const authorization = ctx.req.header('authorization');

src/servers/_middlewares/user-middleware.ts

@@ -25,7 +25,7 @@ export const userMiddleware: MiddlewareHandler = async function (ctx, next) {
 
   // There was an Origin check here until 2026-08-13. It is gone with the rest of origin validation —
   // it had defaulted to off, so it ran on no real install. A valid token is required below, and the
-  // capability gate in hono.ts confines a non-owner to what their role grants.
+  // permission gate in hono.ts confines a non-owner to what their role grants.
 
   try {
     // Both credentials resolve here — see auth-token.ts. Everything below applies to a session JWT only: