Permissions: rename Grants, add wildcards, local groups, profile

- Rename Grant -> Permission end-to-end (model, routes, view, frontend,
  bootstrap) and add an idempotent redis migration for existing records.
- utils/roles.js: glob domain matching (* = one label, ** = any depth) against
  the full host; authz passes the full hostname.
- Local groups: LocalGroup model + admin routes/UI; membership merged into
  Permission.effectiveFor so app groups behave like SSO groups.
- Subject autocomplete via GET /api/permission/subjects (users + derived groups).
- User profile page (/profile) and username in the navbar; /api/user/me now
  returns merged/local/external groups.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/user.js

@@ -45,7 +45,11 @@ router.get('/me', async function(req, res, next){
 		let effective = await authz.getEffective(req);
 		return res.json({
 			username: authz.reqUsername(req),
-			groups: req.groups || [],
+			// Merged groups (external + local); localGroups is the app-managed
+			// subset, externalGroups the ones from SSO/LDAP.
+			groups: effective.groups || req.groups || [],
+			localGroups: effective.localGroups || [],
+			externalGroups: req.groups || [],
 			isAdmin: effective.isAdmin,
 			global: effective.global,
 			domains: effective.domains,