Permissions: rename Grants, add wildcards, local groups, profile

- Rename Grant -> Permission end-to-end (model, routes, view, frontend,
  bootstrap) and add an idempotent redis migration for existing records.
- utils/roles.js: glob domain matching (* = one label, ** = any depth) against
  the full host; authz passes the full hostname.
- Local groups: LocalGroup model + admin routes/UI; membership merged into
  Permission.effectiveFor so app groups behave like SSO groups.
- Subject autocomplete via GET /api/permission/subjects (users + derived groups).
- User profile page (/profile) and username in the navbar; /api/user/me now
  returns merged/local/external groups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/render.js

@@ -42,8 +42,16 @@ router.get('/users', async function(req, res, next) {
   res.render('users', {...values});
 });
 
-router.get('/grants', async function(req, res, next) {
-  res.render('grants', {...values});
+router.get('/permissions', async function(req, res, next) {
+  res.render('permissions', {...values});
+});
+
+router.get('/groups', async function(req, res, next) {
+  res.render('groups', {...values});
+});
+
+router.get('/profile', async function(req, res, next) {
+  res.render('profile', {...values});
 });
 
 // Bare /login (the OIDC callback redirect target) and /login/<path>.