the plugin system says permissions, not the other word

i named the field permissions and then narrated in the overloaded one anyway,
which is worse than either — the whole reason for the rename was that the word
already means three things here.

renamed what was mine: setPluginCapabilities -> setPluginPermissions,
pluginCapabilities -> pluginPermissions, and the prose throughout.

what remains is the platform's own vocabulary, not the plugin system's: the
 type it imports, and the  field on a dock manifest,
which is the shape the shell already renders. renaming those is a separate
change to a separate system and is the owner's to make.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/plugins/generate.ts

@@ -19,8 +19,8 @@ import type { PluginState } from './mount';
 // ── What is NOT here ──
 //
 // The dock tile. It is permission-filtered, and permission is a runtime question: a grant takes effect on
-// the next request, not on the next build. So the tile comes from `/api/user/capabilities` like every
-// other plugin manifest, and this file carries only what the BUNDLER needs.
+// the next request, not on the next build. So the tile is served by the self endpoint at request time,
+// and this file carries only what the BUNDLER needs.
 
 const GENERATED_PATH = join(PLATFORM_DIR, 'src/apps/officer-web/Plugins.gen.tsx');
 const BUILD_DIR = join(PLATFORM_DIR, 'build');