Rename the coarse gate from role to permission, matching RBAC

src/ui/shell-context.ts

@@ -1,7 +1,7 @@
 // Shell view-model builder: the brand/theme/user/title block every app-shell page
 // (the home dashboard, the built-in admin screens) hands to shell.ejs. Pure. Extracted so the
 // shell user is the *real* signed-in identity — no hardcoded demo profile — and branding is
-// read from one place. The User carries no display name (the JWT holds only id/email/roles), so
+// read from one place. The User carries no display name (the JWT holds only id/email/permissions), so
 // the profile shows the email's local part as the name with the full email beneath, initials from
 // the local part; anonymous ⇒ "Guest".