feat: permissions, a console for everyone who manages something, and catalog management

Phase 1 of docs/console.md: permissions as resource:action strings in role
bundles at a scope; the console for anyone controlling a catalog, product
or room, with a tagged audit log scoped by permission and filters;
catalog settings (rating ceiling, upload policy), key rotation, operators,
membership (approval, invitations, bans) enforced when getting and
wearing products, delisting, suspension, and the catalogs' changes feed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/components/header.tsx

@@ -1,6 +1,6 @@
 import Image from "next/image";
 import Link from "next/link";
-import { getMe, isModerator } from "@/lib/api";
+import { getMe } from "@/lib/api";
 import { buttonVariants } from "@/components/ui/button";
 import { NavLink, ProfileMenu } from "./header-client";
 import logo from "./t5de.png";
@@ -28,7 +28,7 @@ export async function Header() {
             Download
           </a>
           {me ? (
-            <ProfileMenu username={me.username} picture={me.picture} console={isModerator(me)} />
+            <ProfileMenu username={me.username} picture={me.picture} console={me.console} />
           ) : (
             <>
               <Link href="/signin" className={buttonVariants({ variant: "ghost" })}>