feat: permissions, a console for everyone who manages something, and catalog management

Phase 1 of docs/console.md: permissions as resource:action strings in role
bundles at a scope; the console for anyone controlling a catalog, product
or room, with a tagged audit log scoped by permission and filters;
catalog settings (rating ceiling, upload policy), key rotation, operators,
membership (approval, invitations, bans) enforced when getting and
wearing products, delisting, suspension, and the catalogs' changes feed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/test/hub.test.ts

@@ -229,8 +229,8 @@ describe("T5DE's proxy", () => {
     const admin = new Browser();
     await admin.call("POST", "/api/auth/sign-in/username", { username: "alice", password: "a long password" });
     const consoleView = (await admin.call("GET", "/api/v1/console")).json;
-    expect(consoleView.online[0]).toMatchObject({ username: "ErinAv", hidden: true });
-    expect(consoleView.counts.computers).toBe(1);
+    expect(consoleView.moderation.online[0]).toMatchObject({ username: "ErinAv", hidden: true });
+    expect(consoleView.moderation.counts.computers).toBe(1);
     await erin.call("PATCH", "/api/v1/account/links/77", { showPresence: true, showBadge: true });
     const online = (await visitor.call("GET", "/api/v1/online")).json.online;
     expect(online).toEqual([