The matrix could not represent board-create, app-create, integration-create,
search-engine-create or media-upload, and savePermissions force-bundled every
create key with its modify/full parent. Together that meant a group with
board-create was silently upgraded to board-full-all on the next save, and the
common "members may create their own boards" setup became unreachable.
- permissionMatrix models create/upload as an orthogonal capability next to the
ordered access levels, so all 20 permission keys round-trip losslessly
- savePermissions stores exactly what was selected
- the matrix UI gets a per-category create checkbox, auto-checked and disabled
when the chosen level already implies it
- a management section is reachable when the user can do at least one thing in
it; nav, pages and stat cards now share one access helper
Thomas Camlong
6728d0a63d