feat(12.1-02): permissioneditor field in radio or checkbox mode

- type: permissioneditor with mode radio (1, -1) or checkbox (1); the
  controller serves the options per request through
  cabana.PermissionEditorProvider and reads and stores the values
- a save answers 422 for a non-object, an unknown code or a value outside the
  mode's set and 403 for a changed locked code; stored codes that are not
  offered are kept
- record responses carry the stored permissions as an object
- SPA: PermissionEditorField with sections by tab, locked rows and a read-only
  mode for the preview
- README, docs, OpenAPI document, TS types and dist updated

admin/src/components/form/formState.ts

@@ -1,6 +1,7 @@
 // Helpers shared by the record form and the settings form: context
 // filtering, the save payload, 422 detail mapping and focus.
 import type { AdminRecord, ErrorBody, FormField } from '../../api/types'
+import { permissionValues } from './control'
 import { isRegistered } from './registry'
 
 /** The screen a field is filtered for: the two form modes and the read-only preview (D-11). */
@@ -56,6 +57,11 @@ export function editablePayload(fields: FormField[], values: AdminRecord, mode:
     if (field.type === 'password' && mode === 'update' && (value === '' || value === null)) {
       continue
     }
+    if (field.type === 'permissioneditor') {
+      // Sent whenever it is shown, reduced to offered codes and values.
+      out[field.name] = permissionValues(field, value)
+      continue
+    }
     if (value !== undefined) {
       out[field.name] = value
     }