refactor(client): route guards resolve effective permissions and drop raw-array helper

- requirePermission checks the effective permission map (deny precedence,
  super-admin bypass) via cached /auth/me/authorization
- remove now-unused features/auth/permissions.ts helpers