RBAC: Catalog scoped permissions and diagnose legacy privilege drift

Nobody has claimed this yet.

## Parent

- #806

## What to build

Deliver the safety-first RBAC entry point. Elsa Server exposes a feature-owned permission catalog with stable keys, authorization scope, implication, sensitivity, and ownership metadata, plus a dry-run diagnostic that classifies current direct, wildcard, unknown, and scope-incompatible grants without changing authority. Elsa Studio provides a read-only security diagnostics surface for reviewing the catalog and migration findings.

Stop privilege drift at the same time: newly seeded tenant administrators receive an explicit tenant permission set rather than wildcard or host authority, existing seeded roles no longer accumulate newly catalogued permissions, and no management path can create new direct local-user grants.

Covers PRD user stories 6-11, 81-85, 92, 95, 98, and 100.

## Acceptance criteria

- [ ] Feature-owned permission descriptors expose stable key, display metadata, category, exactly one allowed authorization scope, implied keys, sensitivity, and owning feature.
- [ ] Startup validation rejects case-insensitive duplicates, missing implication targets, cycles, cross-scope implications, and invalid template keys with actionable diagnostics.
- [ ] A permission-catalog API and a Studio read-only diagnostics experience show catalog entries, validation state, and legacy-grant classifications without exposing secrets or changing authority.
- [ ] Both administrator seed paths create tenant administrators without `*` or host permissions and stop converging existing roles to newly catalogued permissions.
- [ ] New direct-permission writes are disabled while existing values remain readable for migration.
- [ ] The dry run classifies wildcard, unknown, scope-incompatible, and known scope-compatible grants and records enough subject/scope context for later remediation without mutating records.
- [ ] Existing permission keys remain unchanged; validation enforces lowercase dot-separated keys only for newly introduced permissions.
- [ ] Composed Server-over-HTTP and Studio integration tests prove the catalog and diagnostic experience, while startup and seed tests prove fail-fast validation and the absence of privilege drift.

## Blocked by

None - can start immediately.

Start by locating the Elsa Server permission and administrator-seeding entry points, then the Studio read-only diagnostics surface described in the issue. Review the startup, seed, Server-over-HTTP, and Studio integration tests first. Done means the catalog and dry run validate and classify grants without mutation, seed paths avoid wildcard or host authority, and direct local-user writes remain readable but cannot create new grants.

Written by the indexing model from the issue text.