Feat v0.7.7 API tokens + extension permissions (#61)

Personal access tokens (PATs) for programmatic API access with
SHA-256 hashing, permission scoping (git model), and Settings/Admin UI.
Extension-declared user permissions with dynamic registry, gate_permission
manifest field, permissions Starlark module, and grouped admin UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/packages.go

@@ -16,6 +16,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"go.starlark.net/starlark"
 
+	"armature/auth"
 	"armature/database"
 	"armature/events"
 	"armature/models"
@@ -193,6 +194,9 @@ func (h *PackageHandler) DeletePackage(c *gin.Context) {
 		return
 	}
 
+	// Unregister user-facing permissions from the dynamic registry
+	auth.UnregisterExtensionPermissions(id)
+
 	// Clean up extracted static assets
 	if h.packagesDir != "" {
 		assetDir := filepath.Join(h.packagesDir, id)