Feat v0.5.0 realtime primitive + dialog audit + permissions UI

Add realtime pub/sub: Starlark realtime.publish() module gated by
new realtime.publish permission, WS room protocol (room.subscribe/
room.unsubscribe intercepted in readPump with 100-room cap), and
SDK sw.realtime.subscribe() with auto room join/leave and reconnect
recovery.

Migrate 5 bare confirm() calls to sw.confirm() with destructive
styling in tasks, schedules, notes (×2), and editor packages.

Add admin permissions UI: per-permission grant/revoke drawer,
Grant All bulk action, pending_review/suspended status badges,
disabled enable toggle when pending. Closes v0.4.7 permissions
UI gap.

8 new Go tests, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/events/bus_test.go

@@ -117,6 +117,12 @@ func TestRouteFor(t *testing.T) {
 		// Extension lifecycle
 		{"extension.loaded", DirLocal},
 		{"extension.error", DirLocal},
+		// Realtime (v0.5.0)
+		{"realtime.chat.message", DirToClient},
+		{"realtime.custom.event", DirToClient},
+		// Room management (v0.5.0)
+		{"room.subscribe", DirFromClient},
+		{"room.unsubscribe", DirFromClient},
 	}
 
 	for _, tt := range tests {
@@ -190,6 +196,27 @@ func TestWaitFor_CleansUpSubscription(t *testing.T) {
 	bus.Publish(Event{Label: "tool.result.cleanup", Payload: json.RawMessage(`{}`)})
 }
 
+func TestRealtimeRouting(t *testing.T) {
+	// realtime.* events should be sent to clients but not accepted from them
+	if !ShouldSendToClient("realtime.chat.message") {
+		t.Error("realtime.* should be sent to client")
+	}
+	if ShouldAcceptFromClient("realtime.chat.message") {
+		t.Error("realtime.* should NOT be accepted from client")
+	}
+
+	// room.subscribe/unsubscribe should be accepted from clients
+	if !ShouldAcceptFromClient("room.subscribe") {
+		t.Error("room.subscribe should be accepted from client")
+	}
+	if !ShouldAcceptFromClient("room.unsubscribe") {
+		t.Error("room.unsubscribe should be accepted from client")
+	}
+	if ShouldSendToClient("room.subscribe") {
+		t.Error("room.subscribe should NOT be sent to client")
+	}
+}
+
 func TestToolCallRouteToClient(t *testing.T) {
 	if !ShouldSendToClient("tool.call.abc123") {
 		t.Error("tool.call.* should be sent to client")