User permissions: redesigned grouped capability editor + catalog

[rpgmem]

Redesigned per-user capability editor (+ editable audience membership)

Rebuilds the FFC permissions section on the WordPress Edit user screen, answering the maintainer's UX ask ("the function is unclear and the admin can't easily understand/cite each capability individually") — and fixing a latent save bug found along the way.

The problems (before)

• The form rendered 10 of ~26 capabilities, as bare labels with no way to tell which machine capability each mapped to.
• Labels were inline __() strings with no central registry → nothing the admin could cite.
• Latent bug: the save handler iterated all 26 caps while the form rendered 10, so every cap without a checkbox was silently remove_cap()'d on each save — e.g. opening + saving an ffc_user's profile would strip a per-user ffc_manage_recruitment grant.

The redesign

• CapabilityCatalog — single source of truth: slug → {label, description, group, level} for all 26 caps. CI asserts it covers exactly CapabilityManager::get_all_capabilities(), so adding a registry cap without metadata fails the build.
• Grouped card layout (Certificates · Appointments · Audiences · Administration–Modules · Administration–Recruitment); admin groups start collapsed.
• Per row: description + copyable monospace slug chip + origin badge (User vs Role) so the admin can see whether a permission comes from the role or a per-user grant.
• Live search (label + slug), Grant/Revoke-all presets, live per-group "granted" count.
• Save fix: render and save both derive from the catalog, so the silent strip is gone.

Context & groups

• Role → read-only context (per the maintainer's decision): role(s) shown for context; editing stays in WordPress' native role selector on the same screen.
• Audiences → editable inline membership (the larger follow-up, now folded in): a checklist of every active audience, pre-checked for current memberships, synced on the same profile-form save. sync_audience_membership() whitelists the submission against the active set and diffs against the current memberships, applying the minimal add_member/remove_member calls. Only active audiences participate, so a membership in an inactive audience is never touched; if no audiences are active (the checklist wouldn't render) the sync is a no-op so it can't wipe membership on an unrelated save. Changes are audit-logged. A link through to the Audiences screen remains for bulk management.

Assets & tests

• New ffc-user-permissions.css; ffc-user-capabilities.js rewritten (vanilla, no jQuery) for presets/search/collapse/copy/live-count. npm run build ran (min bundles in sync).
• CapabilityCatalogTest (registry parity + metadata), updated AdminUserCapabilitiesTest (new markup, enqueue, the formerly-hidden admin caps now render, audience checklist render + membership add/remove/no-op save), new Vitest user-capabilities.test.js, retired the superseded tiny-scripts block.
• Green: PHPUnit 4949 · Vitest 1107 · ESLint · Stylelint · WPCS · PHPStan 8.
• Design mockup committed under docs/mockups/user-permissions-redesign.html.

Targets develop; no FFC_VERSION bump (belongs to the release PR). CHANGELOG under [Unreleased].

https://claude.ai/code/session_011ErkuJ7jnF9zkqCkGs3qKN