Phase 6: Permissions, Push, WebAuthn scaffolding

Backend:
- internal/permissions/permissions.go: permission bitflags (VIEW_CHANNEL through SHARE_SCREEN)
- internal/permissions/checker.go: permission checker with role aggregation
- internal/middleware/permission.go: RequirePermission middleware
- internal/push/handlers.go: push subscription CRUD, VAPID key endpoint, SendPush
- internal/auth/webauthn.go: WebAuthn passkey scaffolding (begin/finish endpoints)
- internal/db/db.go: is_default on roles, push_subscriptions table, webauthn_credentials table
- go.mod: added webpush-go, go-webauthn dependencies

Frontend:
- stores/role.ts: Zustand store for role management
- RoleManager.tsx: role CRUD with permission checkboxes
- MemberRoleAssign.tsx: assign roles to members
- App.tsx: /servers/:serverId/roles route

internal/permissions/permissions.go

@@ -0,0 +1,35 @@
+package permissions
+
+// Permission bitflags.
+const (
+	VIEW_CHANNEL    int64 = 1 << 0
+	SEND_MESSAGES   int64 = 1 << 1
+	MANAGE_MESSAGES int64 = 1 << 2
+	KICK_MEMBERS    int64 = 1 << 3
+	BAN_MEMBERS     int64 = 1 << 4
+	MANAGE_SERVER   int64 = 1 << 5
+	MANAGE_CHANNELS int64 = 1 << 6
+	ADMINISTRATOR   int64 = 1 << 7
+	CONNECT_VOICE   int64 = 1 << 8
+	SPEAK_VOICE     int64 = 1 << 9
+	SHARE_SCREEN    int64 = 1 << 10
+)
+
+// DefaultEveryonePermissions is granted to the @everyone role when a server is created.
+// Bits 0,1,8,9,10 = VIEW_CHANNEL | SEND_MESSAGES | CONNECT_VOICE | SPEAK_VOICE | SHARE_SCREEN = 1539.
+const DefaultEveryonePermissions int64 = VIEW_CHANNEL | SEND_MESSAGES | CONNECT_VOICE | SPEAK_VOICE | SHARE_SCREEN
+
+// Has reports whether the permission set contains the given permission bits.
+func Has(permissions int64, perm int64) bool {
+	return permissions&perm == perm
+}
+
+// Add returns permissions with the given bits set.
+func Add(permissions int64, perm int64) int64 {
+	return permissions | perm
+}
+
+// Remove returns permissions with the given bits cleared.
+func Remove(permissions int64, perm int64) int64 {
+	return permissions &^ perm
+}