Rename the coarse gate from role to permission, matching RBAC

views/auth.ejs

@@ -2,7 +2,7 @@
   Themed Kratos self-service page inside the unified app shell: sign-in / register /
   reset / verify / settings. Renders a FlowView (src/auth/flow-view.ts) into the shell content, reusing the
   auth-card + field partials. The form posts straight to flow.ui.action — Kratos owns its CSRF. The
-  shell's menu is role-filtered (anonymous ⇒ public items + Sign in); the topbar carries no heading,
+  shell's menu is permission-filtered (anonymous ⇒ public items + Sign in); the topbar carries no heading,
   so the card's own <h1> is the page's single heading. Data: chrome (PageChrome), flow (FlowView).
 %><%
   const nav = include("partials/nav-tree", { nodes: chrome.nav });

views/home.ejs

@@ -1,6 +1,6 @@
 <%#
   Public landing page: the ungated "/", rendered inside the unified app shell so the menu
-  shows (role-filtered — anonymous ⇒ public items + Sign in). A brief intro + a prominent way in, or a
+  shows (permission-filtered — anonymous ⇒ public items + Sign in). A brief intro + a prominent way in, or a
   dashboard link when already signed in. A plugin may replace this via its `home` handler.
   Data: chrome (PageChrome), user (or null).
 %><%

views/partials/shell.ejs

@@ -1,7 +1,7 @@
 <%#
   App shell: sidebar (brand + nav slot + footer) · topbar · content slot. The one chrome every page
   renders — dashboard, admin, plugin, login/registration/front — so the menu is identical
-  everywhere, role-filtered to the visitor (anonymous ⇒ public items + Sign in).
+  everywhere, permission-filtered to the visitor (anonymous ⇒ public items + Sign in).
   Slots are pre-rendered HTML locals — `nav` (sidebar tree, see nav-tree partial),
   `actions` (topbar buttons), `body` (page content); `styles` is an optional array of
   extra stylesheet hrefs (e.g. a plugin's own /public/<id>/x.css). Text locals: `title`