feat(capabilities): metadata, frozen registry, scoped grants and requests

- Capabilities declare access (read/write, unknown fails closed as
  write), side effects, idempotency, timeout, cost estimate and the trust
  of their output (web content is low trust). A capability may derive its
  policy target from its parameters; a disagreeing target is refused, and
  approvals whose modified parameters change the target are refused.
- The registry is frozen at start-up; registration afterwards panics.
- Invocation.RequireApproval turns ALLOW into ASK for commitments; it can
  only tighten, and scoped grants never satisfy it.
- Scoped grants (migration 0025): capability, target and parameter globs,
  access, expiry of at most seven days and an optional operation count
  consumed atomically; applied only where policy says ASK. A sweep marks
  lapsed grants and refreshes the self-model, which now lists live grants.
- Capability requests carry scope, duration, operation cap, reason,
  evidence, risk, mitigation, fallback, alternatives and explicit decision
  history; they batch per intention, are capped per mind (operator
  attention budget) and can be decided only by a named person. Component
  names are refused as deciders, for approvals too, and as usernames.
- API routes, OpenAPI entries, scheduler sweeps and approval-centre
  sections for requests and temporary grants.

internal/minds/selfmodel.go

@@ -14,7 +14,19 @@ type SelfModel struct {
 	CurrentGoals       []string           `json:"current_goals"`
 	ConfidenceByDomain map[string]float64 `json:"confidence_by_domain"`
 	KnowledgeGaps      []string           `json:"knowledge_gaps"`
-	UpdatedAt          time.Time          `json:"updated_at"`
+	// Grants lists temporary authority currently in force. The capability
+	// layer rewrites it whenever a grant is made, used up, revoked or expires.
+	Grants    []GrantEntry `json:"grants,omitempty"`
+	UpdatedAt time.Time    `json:"updated_at"`
+}
+
+// GrantEntry is one live scoped grant as the mind sees it.
+type GrantEntry struct {
+	Capability string    `json:"capability"`
+	Target     string    `json:"target"`
+	Access     string    `json:"access"`
+	ExpiresAt  time.Time `json:"expires_at"`
+	Remaining  *int      `json:"remaining_operations,omitempty"`
 }
 
 // CapabilityEntry records one capability and the policy that governs it.