Permissions: rename Grants, add wildcards, local groups, profile

- Rename Grant -> Permission end-to-end (model, routes, view, frontend,
  bootstrap) and add an idempotent redis migration for existing records.
- utils/roles.js: glob domain matching (* = one label, ** = any depth) against
  the full host; authz passes the full hostname.
- Local groups: LocalGroup model + admin routes/UI; membership merged into
  Permission.effectiveFor so app groups behave like SSO groups.
- Subject autocomplete via GET /api/permission/subjects (users + derived groups).
- User profile page (/profile) and username in the navbar; /api/user/me now
  returns merged/local/external groups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/migrations/permission_bootstrap.js

@@ -0,0 +1,40 @@
+'use strict';
+
+/**
+ * Bootstrap a global-admin Permission for a user so there is always someone who
+ * can manage the system after per-domain authorization is enabled.
+ *
+ * Usage:
+ *   node migrations/permission_bootstrap.js [username]
+ *
+ * Defaults to the first entry in conf.auth.adminUsers (or 'proxyadmin2').
+ * Note: members of conf.auth.adminUsers / conf.auth.adminGroups are already
+ * treated as admins without a Permission; this just makes it explicit/visible in
+ * the permission list and survives config changes.
+ */
+
+const conf = require('@simpleworkjs/conf');
+require('../models'); // register all models
+const {Permission} = require('../models/permission');
+
+(async function(){
+	try{
+		let username = process.argv[2]
+			|| (conf.auth && conf.auth.adminUsers && conf.auth.adminUsers[0])
+			|| 'proxyadmin2';
+
+		let permission = await Permission.create({
+			subjectType: 'user',
+			subject: username,
+			scope: 'global',
+			role: 'admin',
+			created_by: username,
+		});
+
+		console.log(`Granted global admin to "${username}":`, permission.id);
+	}catch(error){
+		console.error('permission_bootstrap error', error);
+	}finally{
+		process.exit(0);
+	}
+})();