RBAC: Converge Server and Studio permission consumers

## Parent

- #806

## What to build

Expand the scope-aware authorization tracer to every Elsa permission consumer. Complete the feature-owned permission inventory, move shell and root-mapped endpoints onto the authoritative resolver, and remove remaining exact-match, implicit-wildcard, and locally traversed implication paths. Elsa Studio routes navigation, pages, commands, actions, and feature contributions through its central permission service.

The delivered behavior is a single permission decision across Server and Studio, with capability availability kept separate from entitlement and no role-name checks.

Covers PRD user stories 8-11, 35-36, 47-56, 92-96, and 98.

## Acceptance criteria

- [ ] Every declared endpoint, policy, built-in template, and Studio contribution permission is present in the feature-owned catalog with compatible scope metadata.
- [ ] Shell endpoints, root-mapped endpoints, ASP.NET policies, FastEndpoints, session responses, and Studio use the authoritative expanded permission result.
- [ ] No ordinary endpoint relies on unconditional `*`, exact permission claims, client-side implication traversal, or a role-name check.
- [ ] CI fails for uncatalogued permission use, incompatible scopes, invalid implications, and Studio contribution keys absent from the advertised contract.
- [ ] Studio combines advertised capability availability with entitlement and distinguishes unavailable capability, missing permission, stale session, and forbidden resource behavior.
- [ ] Unauthorized navigation is hidden, direct unauthorized routes render a forbidden experience, and useful contextual actions are disabled with a concise reason.
- [ ] Existing stable permission keys remain compatible and new keys follow the catalog convention.
- [ ] Server inventory/HTTP tests and Studio component/browser tests exercise representative read, manage, publish, execute, diagnostics, secrets, agent, module-management, and Extension Builder surfaces.

## Blocked by

- #829

Start by reviewing blocked issue #829, then inventory the feature-owned catalog and the Server and Studio consumers named in the acceptance criteria. Run the Server inventory/HTTP tests and Studio component/browser tests; done means one authoritative permission decision, catalog and CI coverage, and the specified unauthorized-state behavior across representative surfaces.

Written by the indexing model from the issue text.