feat: permissions, a console for everyone who manages something, and catalog management

Phase 1 of docs/console.md: permissions as resource:action strings in role
bundles at a scope; the console for anyone controlling a catalog, product
or room, with a tagged audit log scoped by permission and filters;
catalog settings (rating ceiling, upload policy), key rotation, operators,
membership (approval, invitations, bans) enforced when getting and
wearing products, delisting, suspension, and the catalogs' changes feed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/catalogs/page.tsx

@@ -1,4 +1,5 @@
 import type { Metadata } from "next";
+import Link from "next/link";
 import { CatalogStatus, membership } from "@/components/catalogs";
 import { PageHeader } from "@/components/status";
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
@@ -71,7 +72,11 @@ function CatalogTable({ catalogs, showStatus = false }: { catalogs: Catalog[]; s
       <TableBody>
         {catalogs.map((c) => (
           <TableRow key={c.id}>
-            <TableCell className="font-medium">{c.name}</TableCell>
+            <TableCell className="font-medium">
+              <Link href={showStatus ? `/console/catalogs/${c.id}` : `/catalogs/${c.id}`} className="underline-offset-4 hover:underline">
+                {c.name}
+              </Link>
+            </TableCell>
             <TableCell className="font-mono text-xs text-muted-foreground">{c.url}</TableCell>
             <TableCell>{membership[c.membership] ?? c.membership}</TableCell>
             {showStatus && <TableCell className="capitalize">{c.visibility}</TableCell>}