/todos: a kanban board over the todo/ tree, owner-only

The filesystem is the database: GET reads the tree through the same module the
index generator now imports, PATCH splices frontmatter (status, priority, due,
order) and never touches a body byte, and every write regenerates TODO.md.
Columns open/doing/blocked/done, native drag between them, selection and theme
filter in the URL. Registry entry 'todos' (kind admin, 22 entries, docs:check
green), isSuperAdmin double-gate on the router.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/servers/permissions/registry.ts

@@ -442,6 +442,17 @@ const CORE_REGISTRY: Permission[] = [
     // is a real route — a client-side redirect still has to resolve before it can send anyone anywhere.
     routes: ['/marketplace', '/plugins'],
   },
+  {
+    key: 'todos',
+    label: 'Todo board',
+    description: "The platform's own backlog — todo/ in the repo, browsed and edited at /todos",
+    // Admin because the subject is the platform's development, not the account's data: the tree lives in
+    // the server's own checkout and a write is a git-visible edit to it. The router double-gates on
+    // isSuperAdmin, same belt-and-braces as the rest of this kind.
+    kind: 'admin',
+    api: ['/todos'],
+    routes: ['/todos'],
+  },
   {
     key: 'server-admin',
     label: 'Server settings',