feat: replace hardcoded permission map with direct OAuth2 scope checks

Remove role-to-permission mapping (usePermissions, RequirePermission) and replace
with direct scope reads from the Logto access token JWT. OrgResolver decodes the
scope claim after /api/me resolves and stores scopes in Zustand. RequireScope and
useScopes replace the old hooks/components across all pages.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui/src/components/RequireScope.tsx

@@ -0,0 +1,13 @@
+import { useScopes } from '../auth/useScopes';
+
+interface Props {
+  scope: string;
+  children: React.ReactNode;
+  fallback?: React.ReactNode;
+}
+
+export function RequireScope({ scope, children, fallback }: Props) {
+  const scopes = useScopes();
+  if (!scopes.has(scope)) return fallback ? <>{fallback}</> : null;
+  return <>{children}</>;
+}