feat(client): effective-permission authorization context with useCan/Can/Cannot

- useAuthorization fetches /auth/me/authorization keyed by active role,
  refreshed on role switch via authKeys invalidation
- useCan/useCanAny/useCanAll + Can/Cannot components backed by the
  effective permission map (deny precedence, super-admin bypass)
- useResourceCan evaluates resource-scoped checks via POST /authorization/check
- PermissionGuard/usePermission delegate to the new source of truth