fix(clients): permission-gate every nav surface to mirror server authorization

[iammukeshm]

Why

A tenant user whose role lacks a module permission could still see and open nav entries for that module, landing on a guaranteed 403 — e.g. the dashboard Files page rendering FAILURE · ForbiddenException for the demo Manager user (Maya Lin), whose role has no Permissions.Files.* grants.

The gating infrastructure (perm/anyPerm on NavSpec, introduced for the Recycle bin in #1294) already existed — most entries just never got gates.

What changed

Dashboard (clients/dashboard)

• nav-data.ts: gate Chat, My Files, Subscription, Invoices, Products, Brands, Categories, and Tickets on the same permission their page's primary endpoint enforces server-side. Live activity (auth-only SSE) and Health (anonymous probe) intentionally stay ungated.
• Command palette: the Navigate and Create actions were a second, fully ungated nav surface. Added perm/anyPerm gates mirroring nav-data.ts and the create endpoints; groups left empty after filtering are dropped.

Admin (clients/admin)

• The Webhooks nav entry and routes had no gate even though the API requires Permissions.Webhooks.View. Added the nav perm + RouteGuard (list + detail), and updated the stale "any signed-in user" comment.
• Mirrored WebhooksPermissions into lib/permissions.ts and added the missing Webhooks group to PERMISSION_CATALOG — without it the Role editor could not grant webhook permissions at all.

DbMigrator demo seed

• The acme Manager role's catalog claims used permission names that do not exist (Permissions.Brands.View vs the real Permissions.Catalog.Brands.View), silently granting nothing — "full catalog" never worked for the Manager demo user. Role permission lists now reference the module contracts constants (CatalogPermissions, IdentityPermissions, TicketsPermissions) so they cannot drift again.
• Existing databases: re-run dotnet run --project src/Host/FSH.Starter.DbMigrator -- seed-demo (idempotent — adds the corrected claims); demo users must re-login to pick them up.

Server-side enforcement is unchanged — these gates are UX, the API remains the authority.

Testing

• Dashboard Playwright suite: 143 passed.
• Admin Playwright: webhooks/roles/dashboard specs green; full suite has one pre-existing tenants/branding.spec.ts failure that reproduces with these changes stashed (unrelated flake).
• tsc --noEmit + ESLint clean for both apps; DbMigrator builds with 0 warnings.

🤖 Generated with Claude Code