fix(auth): combine trusted permission resolvers with UI-only hints

[zuohuadong]

Summary

Combines PRs #208 and #209 into a single coherent auth hardening change. Both PRs addressed the same security concern (client-side claims treated as authorization facts) but conflicted in 8 files and took slightly different approaches.

What this combined PR does

Trusted resolver architecture (from #208):

• getPermissions() on SSO and Supabase providers now returns null unless the application explicitly configures a trusted resolver
• SSO: getPermissions config option receives { session, getAccessToken, createAuthenticatedFetch }
• Supabase: getPermissions config option receives { client, user }
• No ID-token claims or user_metadata.role are used as permissions

Exact permission matching (from #208):

• createFeatureGate no longer interprets wildcards (* or resource:*)
• Permissions must match exactly

Stronger UI-only documentation (from #209):

• All JSDoc, docs, and types consistently frame getPermissions as UI-only hints
• usePermissions JSDoc: "runs in the browser and never authorizes API, RLS, or action requests"
• types.ts AuthProvider: getPermissions annotated as "UI-only permission hints"
• Chinese and English docs updated with consistent language

Tests

All permission, SSO auth-provider, and Supabase tests pass. The only failing tests are the pre-existing LiteActionButtons tests (local @lucide/svelte stale symlink issue — CI passes fine).

Closes

Supersedes #208 and #209.

[cloudflare-workers-and-pages]

Deploying svadmin-example with    Cloudflare Pages

Latest commit:	de30f7c
Status:	✅  Deploy successful!
Preview URL:	https://1c092e71.svadmin-example.pages.dev
Branch Preview URL:	https://codex-auth-permissions-harde.svadmin-example.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying svadmin with    Cloudflare Pages

Latest commit:	de30f7c
Status:	✅  Deploy successful!
Preview URL:	https://9732cc2a.svadmin.pages.dev
Branch Preview URL:	https://codex-auth-permissions-harde.svadmin.pages.dev

View logs

[zuohuadong]

审查结论：暂不合并（PARTIAL，高风险认证/权限变更）。

阻塞项：公开契约在实现与文档之间不一致。实现中的 SSO/Supabase provider 始终包含 getPermissions()，未配置 resolver 时返回 null（packages/sso/src/auth-provider.ts、packages/supabase/src/auth-provider.ts）；但 docs/auth.md、docs/src/content/docs/hooks/auth.md 和 docs/src/content/docs/providers/auth.md 分别声称内置 provider “未实现”或该方法为 undefined。这会影响调用方用属性存在性做能力检测，也违背本 PR 的中英文文档一致性目标。

请统一为一个明确契约：要么文档全部说明“方法存在，无 trusted resolver 时返回 null”，要么实现/类型改为确实省略属性或返回 undefined，并补对应测试。修复后重新跑 Lint & Test、E2E，并继续高风险复审。

已确认的正向证据：当前 head b9424a6 可合并、GitHub Lint & Test/E2E 全绿；本地 Bun 主测试阶段 546 项通过；默认不再读取 ID-token claims/user_metadata.role，权限匹配改为精确匹配。