feat(12.1-02): permissioneditor field in radio or checkbox mode

- type: permissioneditor with mode radio (1, -1) or checkbox (1); the
  controller serves the options per request through
  cabana.PermissionEditorProvider and reads and stores the values
- a save answers 422 for a non-object, an unknown code or a value outside the
  mode's set and 403 for a changed locked code; stored codes that are not
  offered are kept
- record responses carry the stored permissions as an object
- SPA: PermissionEditorField with sections by tab, locked rows and a read-only
  mode for the preview
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/crud.go

@@ -544,13 +544,17 @@ type actionConflict struct{}
 func (actionConflict) Error() string { return "cabana: action does not apply" }
 
 // projectFullRecord is the D-18 record shape: scalar writable fields, relation
-// values keyed by field name, and their labels.
+// values keyed by field name with their labels, and the stored permissions of
+// every permissioneditor field as an object (D-16).
 func projectFullRecord(ctx context.Context, tx *gorm.DB, cc *CompiledController, model any) (RecordResult, error) {
 	data := projectRecord(cc, model)
 	meta, err := projectRelationFields(ctx, tx, cc, model, data)
 	if err != nil {
 		return RecordResult{}, err
 	}
+	if err := projectPermissionFields(withTx(ctx, tx), cc, model, data); err != nil {
+		return RecordResult{}, err
+	}
 	return RecordResult{Data: data, Meta: meta}, nil
 }
 
@@ -580,6 +584,10 @@ func (s CRUDService) save(ctx context.Context, cc *CompiledController, id any, i
 	if err != nil {
 		return RecordResult{}, err
 	}
+	permissions, err := liftPermissionValues(cc, in.Body, op)
+	if err != nil {
+		return RecordResult{}, err
+	}
 	var result RecordResult
 	err = s.transaction(ctx, func(ctx context.Context, tx *gorm.DB) error {
 		ctx = withVirtualFields(withTx(ctx, tx), virtual)
@@ -633,6 +641,11 @@ func (s CRUDService) save(ctx context.Context, cc *CompiledController, id any, i
 		if err != nil {
 			return err
 		}
+		// D-16: permission values are checked against the controller's
+		// options and stored by the controller before the row write.
+		if err := applyPermissionValues(ctx, cc, target, permissions, update); err != nil {
+			return err
+		}
 		// D-18: submitted ids pass the same scoped query as the options
 		// endpoint; belongsTo keys land before the row write, pivot rows after.
 		if err := checkRelationScope(ctx, tx, cc, relations); err != nil {