feat(perm): requirePermission + requireBotAccess middleware

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/web/middleware/requireAuth.ts

@@ -9,7 +9,13 @@ import {
 
 declare module "express-serve-static-core" {
   interface Request {
-    user?: { id: string; username: string; role: "admin" | "member" };
+    user?: {
+      id: string;
+      username: string;
+      role: "admin" | "member";
+      capabilities?: Set<string>;
+      bots?: "all" | Set<string>;
+    };
   }
 }