feat: permissions, a console for everyone who manages something, and catalog management

Phase 1 of docs/console.md: permissions as resource:action strings in role
bundles at a scope; the console for anyone controlling a catalog, product
or room, with a tagged audit log scoped by permission and filters;
catalog settings (rating ceiling, upload policy), key rotation, operators,
membership (approval, invitations, bans) enforced when getting and
wearing products, delisting, suspension, and the catalogs' changes feed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/components/catalogs.tsx

@@ -2,9 +2,9 @@ import { Tag } from "@/components/status";
 
 export const membership: Record<string, string> = { open: "Open", approval: "By approval", invite: "Invite only" };
 
-/** A catalog's review status: approved, pending or rejected. */
+/** A catalog's status: approved, pending, rejected or suspended. */
 export function CatalogStatus({ status }: { status: string }) {
   if (status === "approved") return <Tag tone="strong">approved</Tag>;
-  if (status === "rejected") return <Tag tone="danger">rejected</Tag>;
+  if (status === "rejected" || status === "suspended") return <Tag tone="danger">{status}</Tag>;
   return <Tag>{status}</Tag>;
 }