feat: replace hardcoded permission map with direct OAuth2 scope checks

Remove role-to-permission mapping (usePermissions, RequirePermission) and replace
with direct scope reads from the Logto access token JWT. OrgResolver decodes the
scope claim after /api/me resolves and stores scopes in Zustand. RequireScope and
useScopes replace the old hooks/components across all pages.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui/src/components/Layout.tsx

@@ -6,6 +6,7 @@ import {
   TopBar,
 } from '@cameleer/design-system';
 import { useAuth } from '../auth/useAuth';
+import { useScopes } from '../auth/useScopes';
 import { EnvironmentTree } from './EnvironmentTree';
 
 // Simple SVG logo mark for the sidebar header
@@ -100,7 +101,8 @@ function PlatformIcon() {
 
 export function Layout() {
   const navigate = useNavigate();
-  const { logout, isPlatformAdmin } = useAuth();
+  const { logout } = useAuth();
+  const scopes = useScopes();
 
   const [envSectionOpen, setEnvSectionOpen] = useState(true);
   const [collapsed, setCollapsed] = useState(false);
@@ -144,7 +146,7 @@ export function Layout() {
       </Sidebar.Section>
 
       {/* Platform Admin section */}
-      {isPlatformAdmin && (
+      {scopes.has('platform:admin') && (
         <Sidebar.Section
           icon={<PlatformIcon />}
           label="Platform"