Feat v0.7.7 API tokens + extension permissions (#61)

Personal access tokens (PATs) for programmatic API access with
SHA-256 hashing, permission scoping (git model), and Settings/Admin UI.
Extension-declared user permissions with dynamic registry, gate_permission
manifest field, permissions Starlark module, and grouped admin UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/permissions.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"log"
+	"sync"
 
 	"armature/database"
 	"armature/store"
@@ -30,9 +31,8 @@ const (
 	PermTokenUnlimited     = "token.unlimited"       // bypass token budgets
 )
 
-// AllPermissions is the complete set of valid permission strings.
-// Used for validation in handlers and rendering checkboxes in admin UI.
-var AllPermissions = []string{
+// KernelPermissions is the static set of platform permission strings.
+var KernelPermissions = []string{
 	PermSurfaceAdminAccess,
 	PermExtensionUse,
 	PermExtensionInstall,
@@ -42,6 +42,63 @@ var AllPermissions = []string{
 	PermTokenUnlimited,
 }
 
+// AllPermissions is the kernel permissions. For the complete set including
+// extension-declared permissions, use AllPermissionsWithExtensions().
+// Kept as a var for backward compatibility with EnsureAdminsGroup and
+// other call sites that only need kernel permissions.
+var AllPermissions = KernelPermissions
+
+// ── Extension Permission Registry ────────────
+
+var (
+	extPermsMu sync.RWMutex
+	extPerms   = make(map[string][]string) // packageID → declared user permissions
+)
+
+// RegisterExtensionPermissions registers user-facing permissions declared by
+// an extension package. Called on install and at boot for active packages.
+func RegisterExtensionPermissions(packageID string, perms []string) {
+	extPermsMu.Lock()
+	extPerms[packageID] = perms
+	extPermsMu.Unlock()
+}
+
+// UnregisterExtensionPermissions removes user-facing permissions declared by
+// an extension package. Called on uninstall.
+func UnregisterExtensionPermissions(packageID string) {
+	extPermsMu.Lock()
+	delete(extPerms, packageID)
+	extPermsMu.Unlock()
+}
+
+// AllPermissionsWithExtensions returns kernel + extension-declared permissions.
+func AllPermissionsWithExtensions() []string {
+	extPermsMu.RLock()
+	defer extPermsMu.RUnlock()
+
+	result := make([]string, len(KernelPermissions))
+	copy(result, KernelPermissions)
+	for _, perms := range extPerms {
+		result = append(result, perms...)
+	}
+	return result
+}
+
+// AllPermissionsGrouped returns permissions grouped by source.
+// "kernel" key holds platform permissions; other keys are package IDs.
+func AllPermissionsGrouped() map[string][]string {
+	extPermsMu.RLock()
+	defer extPermsMu.RUnlock()
+
+	result := map[string][]string{
+		"kernel": KernelPermissions,
+	}
+	for pkgID, perms := range extPerms {
+		result[pkgID] = perms
+	}
+	return result
+}
+
 // ── Resolution ──────────────────────────────
 
 // ResolvePermissions returns the effective permission set for a user.