Feat v0.7.7 API tokens + extension permissions (#61)

Personal access tokens (PATs) for programmatic API access with
SHA-256 hashing, permission scoping (git model), and Settings/Admin UI.
Extension-declared user permissions with dynamic registry, gate_permission
manifest field, permissions Starlark module, and grouped admin UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/sandbox/permissions_module.go

@@ -0,0 +1,44 @@
+// Package sandbox — permissions_module.go
+//
+// Read-only module for checking user permissions from Starlark scripts.
+// No sandbox permission required — extensions can check whether a user
+// has a specific permission without needing any special grants.
+//
+// Starlark API:
+//   permissions.check(user_id, "image-gen.use")  → True/False
+package sandbox
+
+import (
+	"context"
+
+	"go.starlark.net/starlark"
+	"go.starlark.net/starlarkstruct"
+
+	"armature/auth"
+	"armature/store"
+)
+
+// BuildPermissionsModule creates the "permissions" module.
+// Always available to all extensions (no permission gate).
+func BuildPermissionsModule(ctx context.Context, stores store.Stores) *starlarkstruct.Module {
+	return MakeModule("permissions", starlark.StringDict{
+		"check": starlark.NewBuiltin("permissions.check", func(
+			thread *starlark.Thread, b *starlark.Builtin,
+			args starlark.Tuple, kwargs []starlark.Tuple,
+		) (starlark.Value, error) {
+			var userID, perm string
+			if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 2, &userID, &perm); err != nil {
+				return nil, err
+			}
+
+			perms, err := auth.ResolvePermissions(ctx, stores, userID)
+			if err != nil {
+				return starlark.False, nil
+			}
+			if perms[perm] {
+				return starlark.True, nil
+			}
+			return starlark.False, nil
+		}),
+	})
+}

server/sandbox/runner.go

@@ -396,6 +396,9 @@ func (r *Runner) buildModulesWithLibCtx(ctx context.Context, packageID string, m
 	}
 	modules["settings"] = BuildSettingsModule(ctx, r.stores, packageID, userID, teamID)
 
+	// Always available — read-only check against kernel permission data
+	modules["permissions"] = BuildPermissionsModule(ctx, r.stores)
+
 	// Allows any starlark package to load declared library dependencies.
 	if lc != nil {
 		modules["lib"] = BuildLibModule(ctx, r, packageID, rc, lc)