feat: frontend permissions and the merged-permission resolver

- PermissionSet reads the stored JSON tolerantly and writes an object
  of integers; FrontendPermission is the catalogue row
- MergedPermissions, HasPermission and UserHasPermission port PHP
  getMergedPermissions and Winter's hasPermission: groups merge with
  most positive wins, the user's own values override, held means
  exactly 1, wildcards as in Winter
- User gains Permissions (never serialized) and declares the avatar
  attachment relation the user API already writes

models/user.go

@@ -3,6 +3,7 @@ package models
 import (
 	"time"
 
+	"git.golem15.com/golem15/summercms/modules/lagoon/attach"
 	"gorm.io/gorm"
 )
 
@@ -33,6 +34,11 @@ type User struct {
 	// minutes (classes.TouchLastSeen). It is shown in the admin list and is
 	// never part of a user API payload.
 	LastSeen *time.Time `gorm:"column:last_seen" json:"-"`
+	// Permissions are the user's own frontend permissions (1 allows, -1
+	// denies). classes.MergedPermissions combines them with the groups'. They
+	// are written by the admin permission editor only and are never part of
+	// a user API payload.
+	Permissions PermissionSet `gorm:"column:permissions" json:"-"`
 	// CreatedAt and UpdatedAt are read-only: the database defaults fill them
 	// and GORM never writes or stamps them through this model.
 	CreatedAt time.Time      `gorm:"column:created_at;->" json:"-"`
@@ -50,6 +56,17 @@ func (User) TableName() string { return "users" }
 // MorphName is the PHP class string stored in system_files.attachment_type.
 func (User) MorphName() string { return `Golem15\User\Models\User` }
 
+// AvatarField is the attachOne relation name of the user's display picture,
+// the value of system_files.field the user API writes.
+const AvatarField = "avatar"
+
+// AttachRelations declares the public attachOne avatar (PHP $attachOne), so
+// the admin form's file upload edits the same attachment the user API
+// serves.
+func (User) AttachRelations() []attach.Relation {
+	return []attach.Relation{{Name: AvatarField, Public: true}}
+}
+
 // Fillable is the register/update field list. Username, PIN, and GDPR columns
 // stay out of Phase 7 because no ported handler reads them.
 func (User) Fillable() []string {