fix: address CodeRabbit review findings

- Apply app search permission filter after limit (access filtering before truncation)
- Allow board-modify-all users to search apps (spotlight regression)
- Skip integration permission queries for anonymous sessions
- Add deterministic sort tie-breakers (kind, name, id)
- Extract shared integration access relations helper
- Replace double type assertion with typed lookup in savePermissions
- Add regression tests: board-modify-all app search, integration-create
  bundling, global full-access branch, matrix round-trip expansion

packages/definitions/src/test/permissions.spec.ts

@@ -116,4 +116,9 @@ describe("matrix helpers should round-trip stably", () => {
     expect(roundTripped).toEqual(expect.arrayContaining(permissions));
     expect(roundTripped).toHaveLength(permissions.length);
   });
+
+  test("expect a single higher-level key to expand to its full set on round-trip", () => {
+    const roundTripped = matrixStateToPermissions(permissionsToMatrixState(["board-full-all"]));
+    expect(roundTripped).toEqual(["board-view-all", "board-modify-all", "board-full-all"]);
+  });
 });