feat(capabilities): metadata, frozen registry, scoped grants and requests

- Capabilities declare access (read/write, unknown fails closed as
  write), side effects, idempotency, timeout, cost estimate and the trust
  of their output (web content is low trust). A capability may derive its
  policy target from its parameters; a disagreeing target is refused, and
  approvals whose modified parameters change the target are refused.
- The registry is frozen at start-up; registration afterwards panics.
- Invocation.RequireApproval turns ALLOW into ASK for commitments; it can
  only tighten, and scoped grants never satisfy it.
- Scoped grants (migration 0025): capability, target and parameter globs,
  access, expiry of at most seven days and an optional operation count
  consumed atomically; applied only where policy says ASK. A sweep marks
  lapsed grants and refreshes the self-model, which now lists live grants.
- Capability requests carry scope, duration, operation cap, reason,
  evidence, risk, mitigation, fallback, alternatives and explicit decision
  history; they batch per intention, are capped per mind (operator
  attention budget) and can be decided only by a named person. Component
  names are refused as deciders, for approvals too, and as usernames.
- API routes, OpenAPI entries, scheduler sweeps and approval-centre
  sections for requests and temporary grants.

internal/ui/ui.go

@@ -125,10 +125,21 @@ func (u *UI) parse(fsys fs.FS) error {
 		"roles":     auth.AllRoles,
 		"date":      func(t time.Time) string { return t.Local().Format("2006-01-02 15:04") },
 		"ago":       ago,
-		"duration":  func(s int64) string { return (time.Duration(s) * time.Second).Truncate(time.Second).String() },
-		"bytes":     humanBytes,
-		"pct":       func(f float64) string { return fmt.Sprintf("%.0f%%", f*100) },
-		"list":      func(xs ...string) []string { return xs },
+		"duration": func(v any) string {
+			var secs int64
+			switch x := v.(type) {
+			case int:
+				secs = int64(x)
+			case int64:
+				secs = x
+			case float64:
+				secs = int64(x)
+			}
+			return (time.Duration(secs) * time.Second).Truncate(time.Second).String()
+		},
+		"bytes": humanBytes,
+		"pct":   func(f float64) string { return fmt.Sprintf("%.0f%%", f*100) },
+		"list":  func(xs ...string) []string { return xs },
 		"conf": func(v any) string {
 			switch x := v.(type) {
 			case float64: