feat(12.1-02): permissioneditor field in radio or checkbox mode

- type: permissioneditor with mode radio (1, -1) or checkbox (1); the
  controller serves the options per request through
  cabana.PermissionEditorProvider and reads and stores the values
- a save answers 422 for a non-object, an unknown code or a value outside the
  mode's set and 403 for a changed locked code; stored codes that are not
  offered are kept
- record responses carry the stored permissions as an object
- SPA: PermissionEditorField with sections by tab, locked rows and a read-only
  mode for the preview
- README, docs, OpenAPI document, TS types and dist updated

modules/cabana/http.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"reflect"
 	"slices"
@@ -699,6 +700,13 @@ func (s *service) formSchema(w http.ResponseWriter, r *http.Request) {
 			}
 			kept = append(kept, field)
 		}
+		// A permission editor's options are the controller's answer for this
+		// administrator (D-16); kept is this request's own slice.
+		if err := localizePermissionOptions(r.Context(), s.translator(), cc, kept); err != nil {
+			slog.Error("cabana: permission options failed", "controller", controllerID(cc), "error", err)
+			WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+			return
+		}
 		view.Fields = kept
 		view.Assets = s.controllerAssets(cc)
 		meta := map[string]any{}