feat: permissions, a console for everyone who manages something, and catalog management

Phase 1 of docs/console.md: permissions as resource:action strings in role
bundles at a scope; the console for anyone controlling a catalog, product
or room, with a tagged audit log scoped by permission and filters;
catalog settings (rating ceiling, upload policy), key rotation, operators,
membership (approval, invitations, bans) enforced when getting and
wearing products, delisting, suspension, and the catalogs' changes feed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/test/registration.test.ts

@@ -63,7 +63,7 @@ test("closed: new accounts wait for approval; the first one runs the hub", async
   expect((await call(bo, "GET", "/api/v1/console")).status).toBe(403);
 
   // Moderators see who's waiting, and approve them.
-  expect((await call(admin, "GET", "/api/v1/console")).json.counts.waiting).toBe(1);
+  expect((await call(admin, "GET", "/api/v1/console")).json.moderation.counts.waiting).toBe(1);
   const waiting = (await call(admin, "GET", "/api/v1/console/people?waiting=true")).json.people;
   expect(waiting.map((p: any) => p.username)).toEqual(["bo_"]);
   expect((await call(admin, "POST", `/api/v1/console/people/${waiting[0].id}/approve`)).json.person.approved).toBe(true);