feat: customizable permissions, per-item Ops ACLs, area-lead roles

Migration 023 (folded into schema.sql section 15). ADDITIVE and
backward compatible: with no permission/ACL rows the app behaves
exactly as before.

Schema:
- space_role_permissions (space_id, subject, permission); ops_acl
  (space_id, entity_type secret|kb|process|area_lead, entity_id,
  role). Full RLS, writes admin/board.
- user_effective_roles(uid,sid): built-in role + custom-role slugs +
  area_lead:<id> for areas the member leads. SECURITY DEFINER.
- user_has_permission(uid,sid,perm): admin implicit-all else a grant
  via an effective role. SECURITY DEFINER.
- secrets/knowledge_base SELECT rewritten as
  `exact existing rule OR ops_acl match` (only widens; zero change
  with no ACL rows). Seed + backfill default role permissions.

Area-lead roles reuse the existing area_leads table rather than
duplicating the concept: a row is a role, lead_id NULL = Vacant,
assigning sets lead_id, the member then holds area_lead:<id>.

App:
- lib/permissions-catalog.ts (codes + per-role defaults + guardrails),
  Zod schemas, lib/actions/permissions.ts (setRolePermissions,
  setOpsAcl, createAreaLeadRole, assign/unassign/delete).
- Customize gains Permissions (role x permission matrix, admin shown
  implicit-all/locked) and Area leads (create/Vacant/assign) panels,
  modular under customize/panels/. Reusable
  components/ops/ops-acl-editor.tsx wired into the Secrets list.

Audit-found latent fixes:
- revealSecret errors on encrypted-but-no-ciphertext corruption
  instead of silently returning the stale plaintext column.
- upsertAreaLead rejects null/empty area_code (NULLs are distinct in
  unique constraints; allowed duplicate rows).

types/database.ts: added the two new tables. 271/271 tests pass,
build clean. KB-modal ACL wiring + members-row shortcut deferred and
tracked in HANDOFF.

app/(app)/ops/page.tsx

@@ -12,8 +12,9 @@ export default async function OpsPage() {
   if (!member) return null
 
   const canSeeSecrets = member.role === 'admin' || member.role === 'board'
+  const canManageAcl = member.role === 'admin' || member.role === 'board'
 
-  const [{ data: kbEntries }, { data: areaLeads }, secretsResult] = await Promise.all([
+  const [{ data: kbEntries }, { data: areaLeads }, secretsResult, { data: customRoles }, { data: acl }] = await Promise.all([
     supabase.from('knowledge_base').select('*').eq('space_id', member.space_id).order('is_pinned', { ascending: false }).order('created_at', { ascending: false }),
     supabase.from('area_leads').select('*').eq('space_id', member.space_id).order('area_name'),
     canSeeSecrets
@@ -22,8 +23,26 @@ export default async function OpsPage() {
       // through the revealSecret() server action.
       ? supabase.from('secrets').select('id, title, area, created_at, label, description, icon, space_id, created_by, updated_at, category, notes, encryption_version').eq('space_id', member.space_id)
       : Promise.resolve({ data: [] as Tables<'secrets'>[] }),
+    supabase.from('space_custom_roles').select('slug, name').eq('space_id', member.space_id),
+    supabase.from('ops_acl').select('entity_type, entity_id, role').eq('space_id', member.space_id),
   ])
 
+  // Selectable ACL roles: built-in roles, custom-role slugs, and area-lead
+  // sentinels labelled by area name.
+  const aclRoleOptions = [
+    { value: 'treasurer', label: 'treasurer' },
+    { value: 'member', label: 'member' },
+    { value: 'associate', label: 'associate' },
+    ...((customRoles ?? []).map(c => ({ value: c.slug, label: c.name }))),
+    ...((areaLeads ?? []).map(al => ({ value: `area_lead:${al.id}`, label: `${al.area_name} lead` }))),
+  ]
+
+  const aclByEntity: Record<string, string[]> = {}
+  for (const row of acl ?? []) {
+    const k = `${row.entity_type}:${row.entity_id}`
+    ;(aclByEntity[k] ??= []).push(row.role)
+  }
+
   return (
     <OpsClient
       member={member as Tables<'space_members'>}
@@ -32,6 +51,9 @@ export default async function OpsPage() {
       areaLeads={areaLeads ?? []}
       secrets={secretsResult.data ?? []}
       canSeeSecrets={canSeeSecrets}
+      canManageAcl={canManageAcl}
+      aclRoleOptions={aclRoleOptions}
+      aclByEntity={aclByEntity}
     />
   )
 }