- Fixed WordPress capability names for permission checking
- Changed 'read_posts' to 'read_post' (correct singular form)
- Fixed 'create_posts' to use 'edit_posts' (WordPress standard)
- Admin users now show correct permissions in API manifest
- All capabilities now report correctly

SHA256: a37e32b4257c7947cd1bbba6cfdcee1dac1f76ae1eb5f0163eb7ad199b126d12