feat(permissions): client-side RBAC capability gating across the UI

[rafavalls]

What is this contribution about?

This PR introduces a proactive client-side permissions layer that mirrors the server-side AccessControl logic. Custom-role users now see disabled/hidden UI and clean empty states for sections they can't access, rather than hitting API errors. The core primitives are a useCapability / useCapabilities hook, a RequireCapability route-level guard, a PermissionTooltip wrapper for inline disabled states, and a NoPermissionState empty-state component. Capability checks are applied across settings pages, connections, agents, automations, monitoring, and AI providers. Server-side AccessControl also received a small fix to always grant basic-usage tools regardless of role.

Screenshots/Demonstration

UI-only change — capability-gated sections show a clean "You don't have permission" empty state for restricted roles, and action buttons show a tooltip explaining the restriction on hover.

How to Test

1. Create a custom role with a limited permission set (e.g. no connections:manage).
2. Assign that role to a member and log in as that member.
3. Navigate to Connections — expect a no-permission empty state instead of an error.
4. Hover over any disabled action button — expect the permission tooltip to appear.
5. Log in as owner/admin — all sections should remain fully accessible.

Review Checklist

• PR title is clear and descriptive
• Changes are tested and working
• Documentation is updated (if needed)
• No breaking changes

---

Summary by cubic

Add client‑side RBAC capability gating so users only see or can click what their role allows, with clean “No access” states and helpful tooltips. Introduces a capability model that mirrors server checks and auto‑grants basic usage tools to all members.

• New Features

  • New primitives: useCapability/useCapabilities, RequireCapability, PermissionTooltip, NoPermissionState.
  • Applied gating across settings (general, brand, members, roles, security, registry/store, monitoring), connections, agents, automations, and AI providers; settings sidebar hides items without access.
  • Added a hidden basic-usage capability; tools under it are always allowed for org members, reducing friction for read‑only/essential actions.
  • Enabled Better Auth dynamic access control in migration to create custom role tables; local‑dev fallback prints invitation accept URL to the console.

• Refactors

  • Rebuilt the role editor to use grouped “permission capabilities” with simple toggles and “dangerous” indicators; removed per‑tool UI.
  • Centralized capability definitions in PERMISSION_CAPABILITIES with helpers for grouping and toggling.
  • Replaced error‑prone actions with disabled buttons and clear tooltips, plus route‑level guards that show a friendly “No access” empty state.

^{Written for commit a2ff84f. Summary will update on new commits. Review in cubic}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[github-actions]

Release Options

Suggested: Minor (2.297.0) — based on feat: prefix

React with an emoji to override the release type:

Reaction	Type	Next Version
👍	Prerelease	2.296.1-alpha.1
🎉	Patch	2.296.1
❤️	Minor	2.297.0
🚀	Major	3.0.0

Current version: 2.296.0

Note: If multiple reactions exist, the smallest bump wins. If no reactions, the suggested bump is used (default: patch).