Phase 6: Permissions, Push, WebAuthn scaffolding

Backend:
- internal/permissions/permissions.go: permission bitflags (VIEW_CHANNEL through SHARE_SCREEN)
- internal/permissions/checker.go: permission checker with role aggregation
- internal/middleware/permission.go: RequirePermission middleware
- internal/push/handlers.go: push subscription CRUD, VAPID key endpoint, SendPush
- internal/auth/webauthn.go: WebAuthn passkey scaffolding (begin/finish endpoints)
- internal/db/db.go: is_default on roles, push_subscriptions table, webauthn_credentials table
- go.mod: added webpush-go, go-webauthn dependencies

Frontend:
- stores/role.ts: Zustand store for role management
- RoleManager.tsx: role CRUD with permission checkboxes
- MemberRoleAssign.tsx: assign roles to members
- App.tsx: /servers/:serverId/roles route

internal/middleware/permission.go

@@ -0,0 +1,41 @@
+package middleware
+
+import (
+	"net/http"
+
+	"git.dustin.coffee/hobokenchicken/dumpsterChat/internal/permissions"
+	"github.com/go-chi/chi/v5"
+)
+
+// RequirePermission returns middleware that verifies the authenticated user has
+// the given permission bits in the server identified by the {serverID} URL
+// parameter. Returns 403 Forbidden if the check fails.
+func RequirePermission(checker *permissions.Checker, perm int64) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userID, ok := UserIDFromContext(r.Context())
+			if !ok {
+				http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+				return
+			}
+
+			serverID := chi.URLParam(r, "serverID")
+			if serverID == "" {
+				http.Error(w, `{"error":"serverID is required"}`, http.StatusBadRequest)
+				return
+			}
+
+			allowed, err := checker.CheckPermission(r.Context(), serverID, userID, perm)
+			if err != nil {
+				http.Error(w, `{"error":"server error"}`, http.StatusInternalServerError)
+				return
+			}
+			if !allowed {
+				http.Error(w, `{"error":"forbidden"}`, http.StatusForbidden)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}