Admin UI: manage per-app granular capabilities

- AdminRoles: capability sub-toggles under each granted app
- AdminUsers: per-app direct capability grants; role-derived
  capabilities shown read-only as "(role)"
- types: Role.capabilities + Capability interface

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/types.ts

@@ -5,6 +5,16 @@ export interface Role {
   description: string | null
   is_default: boolean
   app_slugs: string[]
+  capabilities: string[]   // "<app>:<cap>" strings granted to this role
+}
+
+// One capability an app exposes, as returned by /admin/capabilities.
+export interface Capability {
+  app_slug: string
+  slug: string
+  name: string
+  description: string | null
+  sort_order: number
 }
 
 export interface App {