Plan 0.5.0 from the ten highest-scoring items; reserve the plugin id error, translate the duplicate-group refusal, and correct four comments and README passages

src/auth/login.ts

@@ -37,8 +37,8 @@ export interface CompletedLogin {
   permissions: string[];
 }
 
-// The coarse permissions a user holds — directly (`Permission:<name>#members@user:<id>`) or transitively via a
-// group that is a member of the permission. Enumerates the defined permissions (the distinct objects in the Permission
+// The coarse permissions a user holds — directly (`Permission:<name>#granted@user:<id>`) or transitively via a
+// group granted the permission. Enumerates the defined permissions (the distinct objects in the Permission
 // namespace) and asks Keto to resolve each membership, so a permission granted to a group reaches the JWT —
 // matching the OPL model and the admin "Effective access" view. At login/refresh only, never per
 // request; permission count is small, so the per-permission checks are cheap and run in parallel.