feat: customizable permissions, per-item Ops ACLs, area-lead roles

Migration 023 (folded into schema.sql section 15). ADDITIVE and
backward compatible: with no permission/ACL rows the app behaves
exactly as before.

Schema:
- space_role_permissions (space_id, subject, permission); ops_acl
  (space_id, entity_type secret|kb|process|area_lead, entity_id,
  role). Full RLS, writes admin/board.
- user_effective_roles(uid,sid): built-in role + custom-role slugs +
  area_lead:<id> for areas the member leads. SECURITY DEFINER.
- user_has_permission(uid,sid,perm): admin implicit-all else a grant
  via an effective role. SECURITY DEFINER.
- secrets/knowledge_base SELECT rewritten as
  `exact existing rule OR ops_acl match` (only widens; zero change
  with no ACL rows). Seed + backfill default role permissions.

Area-lead roles reuse the existing area_leads table rather than
duplicating the concept: a row is a role, lead_id NULL = Vacant,
assigning sets lead_id, the member then holds area_lead:<id>.

App:
- lib/permissions-catalog.ts (codes + per-role defaults + guardrails),
  Zod schemas, lib/actions/permissions.ts (setRolePermissions,
  setOpsAcl, createAreaLeadRole, assign/unassign/delete).
- Customize gains Permissions (role x permission matrix, admin shown
  implicit-all/locked) and Area leads (create/Vacant/assign) panels,
  modular under customize/panels/. Reusable
  components/ops/ops-acl-editor.tsx wired into the Secrets list.

Audit-found latent fixes:
- revealSecret errors on encrypted-but-no-ciphertext corruption
  instead of silently returning the stale plaintext column.
- upsertAreaLead rejects null/empty area_code (NULLs are distinct in
  unique constraints; allowed duplicate rows).

types/database.ts: added the two new tables. 271/271 tests pass,
build clean. KB-modal ACL wiring + members-row shortcut deferred and
tracked in HANDOFF.

lib/validations.ts

@@ -486,6 +486,42 @@ export const createChannelSchema = z.object({
   channel_type: z.enum(['general', 'area', 'ops', 'project']).default('general'),
 })
 
+// ─── Permissions, Ops ACLs, area-lead roles ──────────────────────────────────
+
+// A grant subject is a built-in role or a custom-role slug.
+const roleSubject = z.string().min(1).max(50).regex(/^[a-z0-9][a-z0-9_:-]{0,49}$/, 'Invalid role')
+
+export const setRolePermissionsSchema = z.object({
+  subject: roleSubject,
+  permissions: z.array(z.string().min(1).max(60)).max(64),
+})
+
+export const opsEntityTypeSchema = z.enum(['secret', 'kb', 'process', 'area_lead'])
+
+// The UI sends the full desired role list for one item; the server replaces.
+// An empty list means "fall back to the item's existing visibility rule".
+export const setOpsAclSchema = z.object({
+  entity_type: opsEntityTypeSchema,
+  entity_id: z.string().uuid('Invalid entity ID'),
+  roles: z.array(z.string().min(1).max(64)).max(64),
+})
+
+export const createAreaLeadRoleSchema = z.object({
+  area_code: z.string().min(1).max(60).regex(/^[a-z0-9][a-z0-9_-]{0,59}$/, 'Invalid area code'),
+  name: z.string().min(1).max(100),
+  color: z.string().max(20).optional().nullable(),
+})
+
+export const updateAreaLeadRoleSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  color: z.string().max(20).optional().nullable(),
+})
+
+export const assignAreaLeadSchema = z.object({
+  area_lead_role_id: z.string().uuid('Invalid role ID'),
+  member_id: z.string().uuid('Invalid member ID'),
+})
+
 // ─── Generic ID schemas ──────────────────────────────────────────────────────
 
 export const uuidSchema = z.string().uuid('Invalid ID format')