feat(auth): wire permission gating through menu, routes and actions

The store's can()/useCan() helpers existed but were unused. Now:
- src/auth/permissions.ts PERM catalog mirrors backend keys
- every nav item carries a permission; sidebar filter reuses can()
- requirePermission() beforeLoad guard on all child routes (direct URLs
  redirect home when the session lacks the key)
- useCan() hides/disables mutation buttons: moderation actions,
  retranslate, robot-author edit/pause, category + locale CRUD, and the
  reserved-SID assign path (admin:sid:override hint)
- 403 responses toast 无权限执行此操作; can() unit tests added

Co-Authored-By: Claude Fable 5 <[email protected]>

src/lib/errors.ts

@@ -17,6 +17,10 @@ export function handleApiError<T extends FieldValues>(
       }
       return
     }
+    if (error.status === 403) {
+      toast.error('无权限执行此操作')
+      return
+    }
     toast.error(error.message || `请求失败（${error.code}）`)
     return
   }