Feat v0.7.7 API tokens + extension permissions (#61)

Personal access tokens (PATs) for programmatic API access with
SHA-256 hashing, permission scoping (git model), and Settings/Admin UI.
Extension-declared user permissions with dynamic registry, gate_permission
manifest field, permissions Starlark module, and grouped admin UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/permissions_test.go

@@ -0,0 +1,81 @@
+package auth
+
+import (
+	"testing"
+)
+
+func TestRegisterExtensionPermissions(t *testing.T) {
+	// Clean state
+	extPermsMu.Lock()
+	extPerms = make(map[string][]string)
+	extPermsMu.Unlock()
+
+	RegisterExtensionPermissions("image-gen", []string{"image-gen.use", "image-gen.admin"})
+
+	all := AllPermissionsWithExtensions()
+	found := 0
+	for _, p := range all {
+		if p == "image-gen.use" || p == "image-gen.admin" {
+			found++
+		}
+	}
+	if found != 2 {
+		t.Errorf("expected 2 extension permissions, found %d in %v", found, all)
+	}
+
+	// Kernel permissions should also be present
+	for _, kp := range KernelPermissions {
+		foundKernel := false
+		for _, p := range all {
+			if p == kp {
+				foundKernel = true
+				break
+			}
+		}
+		if !foundKernel {
+			t.Errorf("kernel permission %q missing from AllPermissionsWithExtensions()", kp)
+		}
+	}
+}
+
+func TestUnregisterExtensionPermissions(t *testing.T) {
+	extPermsMu.Lock()
+	extPerms = make(map[string][]string)
+	extPermsMu.Unlock()
+
+	RegisterExtensionPermissions("image-gen", []string{"image-gen.use"})
+	UnregisterExtensionPermissions("image-gen")
+
+	all := AllPermissionsWithExtensions()
+	for _, p := range all {
+		if p == "image-gen.use" {
+			t.Error("unregistered permission should not appear")
+		}
+	}
+}
+
+func TestAllPermissionsGrouped(t *testing.T) {
+	extPermsMu.Lock()
+	extPerms = make(map[string][]string)
+	extPermsMu.Unlock()
+
+	RegisterExtensionPermissions("chat", []string{"chat.send", "chat.admin"})
+	RegisterExtensionPermissions("notes", []string{"notes.edit"})
+
+	grouped := AllPermissionsGrouped()
+
+	if len(grouped["kernel"]) != len(KernelPermissions) {
+		t.Errorf("expected %d kernel permissions, got %d", len(KernelPermissions), len(grouped["kernel"]))
+	}
+	if len(grouped["chat"]) != 2 {
+		t.Errorf("expected 2 chat permissions, got %d", len(grouped["chat"]))
+	}
+	if len(grouped["notes"]) != 1 {
+		t.Errorf("expected 1 notes permission, got %d", len(grouped["notes"]))
+	}
+
+	// Clean up
+	extPermsMu.Lock()
+	extPerms = make(map[string][]string)
+	extPermsMu.Unlock()
+}