feat(capabilities): metadata, frozen registry, scoped grants and requests

- Capabilities declare access (read/write, unknown fails closed as
  write), side effects, idempotency, timeout, cost estimate and the trust
  of their output (web content is low trust). A capability may derive its
  policy target from its parameters; a disagreeing target is refused, and
  approvals whose modified parameters change the target are refused.
- The registry is frozen at start-up; registration afterwards panics.
- Invocation.RequireApproval turns ALLOW into ASK for commitments; it can
  only tighten, and scoped grants never satisfy it.
- Scoped grants (migration 0025): capability, target and parameter globs,
  access, expiry of at most seven days and an optional operation count
  consumed atomically; applied only where policy says ASK. A sweep marks
  lapsed grants and refreshes the self-model, which now lists live grants.
- Capability requests carry scope, duration, operation cap, reason,
  evidence, risk, mitigation, fallback, alternatives and explicit decision
  history; they batch per intention, are capped per mind (operator
  attention budget) and can be decided only by a named person. Component
  names are refused as deciders, for approvals too, and as usernames.
- API routes, OpenAPI entries, scheduler sweeps and approval-centre
  sections for requests and temporary grants.

tests/security/ui_actions_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"net/url"
 	"testing"
+	"time"
 
 	"github.com/andydixon/noema/internal/capabilities"
 	"github.com/andydixon/noema/tests/harness"
@@ -43,4 +44,30 @@ func TestOperatorDecidesInTheBrowser(t *testing.T) {
 			t.Fatalf("%s: status %s by %q", decision, a.Status, a.DecisionBy)
 		}
 	}
+	// A mind's capability request is granted (narrowed) from the browser, and
+	// the resulting temporary grant can be revoked there.
+	ops := 20
+	req, err := h.Deps.Capabilities.RequestCapability(ctx, capabilities.CapabilityRequest{MindID: m.ID, Capability: "http.fetch", TargetPattern: "https://status.example.org/*", DurationSeconds: 1800, MaxOperations: &ops, Reason: "status page needed for the incident", Risk: "none beyond one request", Fallback: "ask the operator"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	res, err = c.Get(h.Srv.URL + "/approvals")
+	if err != nil || res.StatusCode != 200 {
+		t.Fatalf("approvals page: %v %d", err, res.StatusCode)
+	}
+	res, err = c.PostForm(h.Srv.URL+"/capability-requests/"+req.ID.String()+"/decide", url.Values{"_csrf": {csrf}, "decision": {"grant"}, "duration_minutes": {"10"}, "max_operations": {"3"}})
+	if err != nil || res.StatusCode != 303 {
+		t.Fatalf("grant form: %v %d", err, res.StatusCode)
+	}
+	grants, _ := h.Deps.Capabilities.ScopedGrants(ctx, m.ID, true)
+	if len(grants) != 1 || *grants[0].MaxOperations != 3 || time.Until(grants[0].ExpiresAt) > 11*time.Minute || grants[0].GrantedBy != "admin" {
+		t.Fatalf("grant from browser: %+v", grants)
+	}
+	res, err = c.PostForm(h.Srv.URL+"/scoped-grants/"+grants[0].ID.String()+"/revoke", url.Values{"_csrf": {csrf}})
+	if err != nil || res.StatusCode != 303 {
+		t.Fatalf("revoke form: %v %d", err, res.StatusCode)
+	}
+	if live, _ := h.Deps.Capabilities.ScopedGrants(ctx, m.ID, true); len(live) != 0 {
+		t.Fatal("grant still live after revoke")
+	}
 }