Feat v0.5.0 realtime primitive + dialog audit + permissions UI

Add realtime pub/sub: Starlark realtime.publish() module gated by
new realtime.publish permission, WS room protocol (room.subscribe/
room.unsubscribe intercepted in readPump with 100-room cap), and
SDK sw.realtime.subscribe() with auto room join/leave and reconnect
recovery.

Migrate 5 bare confirm() calls to sw.confirm() with destructive
styling in tasks, schedules, notes (×2), and editor packages.

Add admin permissions UI: per-permission grant/revoke drawer,
Grant All bulk action, pending_review/suspended status badges,
disabled enable toggle when pending. Closes v0.4.7 permissions
UI gap.

8 new Go tests, all passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/main.go

@@ -168,6 +168,8 @@ func main() {
 	if cfg.StoragePath != "" {
 		starlarkRunner.SetPackagesDir(cfg.StoragePath + "/packages")
 	}
+	// v0.5.0: realtime module — extension publish to WebSocket channels
+	starlarkRunner.SetBus(bus)
 	// v0.38.5: allow extensions to reach private IPs (self-hosted Gitea, etc.)
 	if os.Getenv("EXT_ALLOW_PRIVATE_IPS") == "true" {
 		starlarkRunner.SetAllowPrivateIPs(true)