Permissions: rename Grants, add wildcards, local groups, profile

- Rename Grant -> Permission end-to-end (model, routes, view, frontend,
  bootstrap) and add an idempotent redis migration for existing records.
- utils/roles.js: glob domain matching (* = one label, ** = any depth) against
  the full host; authz passes the full hostname.
- Local groups: LocalGroup model + admin routes/UI; membership merged into
  Permission.effectiveFor so app groups behave like SSO groups.
- Subject autocomplete via GET /api/permission/subjects (users + derived groups).
- User profile page (/profile) and username in the navbar; /api/user/me now
  returns merged/local/external groups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/api.js

@@ -22,7 +22,10 @@ router.use('/dns', middleware.auth, require('./dns'));
 // API routes for working with hosts. All endpoints need to be have valid user.
 router.use('/cert', middleware.auth, require('./cert'));
 
-// Grant management (who can manage which domains) is global-admin-only.
-router.use('/grant', middleware.auth, authz.requireAdmin, require('./grant'));
+// Permission management (who can manage which domains) is global-admin-only.
+router.use('/permission', middleware.auth, authz.requireAdmin, require('./permission'));
+
+// Local group management is global-admin-only.
+router.use('/group', middleware.auth, authz.requireAdmin, require('./group'));
 
 module.exports = router;