feat(auth): require trusted permission resolvers

[zuohuadong]

Summary

• make Supabase and SSO getPermissions() fail closed unless the app provides a trusted resolver
• remove implicit permissions from user-editable Supabase metadata and SSO ID Token claims
• document usePermissions() / createFeatureGate() as UI rendering helpers, not authorization boundaries
• make createFeatureGate() require exact permission strings and add Svelte/Vitest coverage

Validation

• bun run check
• bun run test
• bun run build
• bun run lint
• git diff --check
• NPM_CONFIG_CACHE=/tmp/svadmin-pr-bqxCkt/npm-cache bun run pack:check

Notes

• This is a breaking authorization hardening change.
• API routes, data providers, and database/RLS policies must still enforce authorization independently.
• Custom menu and direct resource-route access-control guards remain a separate UI hardening follow-up.

[cloudflare-workers-and-pages]

Deploying svadmin-example with    Cloudflare Pages

Latest commit:	2f37ed2
Status:	✅  Deploy successful!
Preview URL:	https://54b390b0.svadmin-example.pages.dev
Branch Preview URL:	https://codex-fail-closed-permission.svadmin-example.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying svadmin with    Cloudflare Pages

Latest commit:	2f37ed2
Status:	✅  Deploy successful!
Preview URL:	https://064ff251.svadmin.pages.dev
Branch Preview URL:	https://codex-fail-closed-permission.svadmin.pages.dev

View logs

[zuohuadong]

Superseded by #211, which combines the trusted-resolver architecture from this PR with the stronger UI-only documentation language from #209. All conflict-free, all tests pass.