feat(acl): tree-based access editor + permission-aware UI

Admin — Access Control is now a folder/file tree. Pick a user/group, click a
node to set an allow and/or deny rule there; each node shows the subject's
*effective* rights (letters S V R E C D M) and allow/deny "set here" badges,
computed server-side incl. group membership, inherited folder rules and
deny-wins. New queries: myAccess(paths) and subjectAccess(subjectType,subjectId,paths).

Main UI — actions are hidden when the current (non-admin) user lacks the
permission: create folder/document (Sidebar), drag-to-move, and Save/Delete in
the document view. Adds a permission-gated Delete button to the document
toolbar. Admins bypass and see everything.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/internal/graph/schema.graphql

@@ -61,6 +61,24 @@ type Query {
 
   # Names of the groups a user belongs to (admin only).
   userGroups(username: String!): [String!]!
+
+  # Effective permissions the current user has on each path (for UI gating).
+  myAccess(paths: [String!]!): [PathAccess!]!
+
+  # Effective permissions a subject has on each path (admin only, for the
+  # access-control tree). For a user this includes their group memberships.
+  subjectAccess(subjectType: String!, subjectId: Int!, paths: [String!]!): [PathAccess!]!
+}
+
+type PathAccess {
+  path:       String!
+  canSearch:  Boolean!
+  canView:    Boolean!
+  canRead:    Boolean!
+  canEdit:    Boolean!
+  canCreate:  Boolean!
+  canDelete:  Boolean!
+  canMove:    Boolean!
 }
 
 type Mutation {