feat: permissions, a console for everyone who manages something, and catalog management

Phase 1 of docs/console.md: permissions as resource:action strings in role
bundles at a scope; the console for anyone controlling a catalog, product
or room, with a tagged audit log scoped by permission and filters;
catalog settings (rating ceiling, upload policy), key rotation, operators,
membership (approval, invitations, bans) enforced when getting and
wearing products, delisting, suspension, and the catalogs' changes feed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/design.md

@@ -470,6 +470,8 @@ Phases for products, catalogs and imports (products.md, console.md, imports.md):
 
 1. Permissions and console foundations: the permission check, roles, the console for everyone who controls
    something, a tagged audit log, membership enforced, catalog settings, team and key rotation, suspension.
+   **Done** (2026-11-05), except catalog deletion requests and the hosted rooms' scope, which come with cases
+   (phase 3). Built-in roles are code (`apps/api/src/permissions.ts`); the `role` table comes with custom roles.
 2. Product info: drafts, moderator edits with reasons and locks, info history, unlisted products, tags and category.
 3. Cases (reports, appeals, reviews), file blocks and the catalogs' changes feed; notifications; API tokens;
    two-factor sign-in for sensitive permissions.