feat(auth): wire permission gating through menu, routes and actions

The store's can()/useCan() helpers existed but were unused. Now:
- src/auth/permissions.ts PERM catalog mirrors backend keys
- every nav item carries a permission; sidebar filter reuses can()
- requirePermission() beforeLoad guard on all child routes (direct URLs
  redirect home when the session lacks the key)
- useCan() hides/disables mutation buttons: moderation actions,
  retranslate, robot-author edit/pause, category + locale CRUD, and the
  reserved-SID assign path (admin:sid:override hint)
- 403 responses toast 无权限执行此操作; can() unit tests added

Co-Authored-By: Claude Fable 5 <[email protected]>

src/routes/_authed/studio/articles.tsx

@@ -1,4 +1,5 @@
 import { createFileRoute } from '@tanstack/react-router'
+import { PERM, requirePermission } from '@/auth/permissions'
 import { useState } from 'react'
 import type { ColumnDef } from '@tanstack/react-table'
 import type { StudioArticle } from '@/api/types'
@@ -19,6 +20,7 @@ import {
 } from '@/components/ui/select'
 
 export const Route = createFileRoute('/_authed/studio/articles')({
+  beforeLoad: () => requirePermission(PERM.STUDIO_READ),
   component: ArticlesPage,
 })