1.4.2.1 - Security Fixxes

• Enforced UI permissions from the session on every request.
  • Removed the allow-all fallback and role-value privilege shortcut.
  • Added request-level permission gates for create/install/scan/delete server, users, permissions, audit, settings, plugin settings, scheduled tasks, updates, and restart.
  • Changed assigned servers to appear whenever a server_permissions row exists; individual actions still require their specific server permissions.
  • Hid dashboard admin actions unless the user has the matching global/server permission.
  • Allowed server.properties save via the per-server properties permission instead of admin-only.