feat(permissions): expose the registry over GET /api/v1/permission-catalog

Both permission forms in the admin panel can now render from the backend
registry instead of their own hardcoded lists. Resources come back as an array
so display order is part of the contract, each carrying its Persian label, its
actions, and the clinic_only flag that used to live in the frontend.

contextPermissions() normalizes the no-row branch through the registry too, so
a doctor whose permission row was never provisioned sees the same shape as one
who has it.

Two existing assertions compared the API response against DEFAULT_PERMISSIONS
by identity. The values are unchanged; only key order moved to the registry's,
so both now compare through PermissionCatalog::merge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/api/README.md

@@ -96,6 +96,7 @@ Only **digits** are translated — no characters are stripped, so `IR` in a sheb
 | [settlement.md](settlement.md) | Wallet & settlement requests | 7 |
 | [rating.md](rating.md) | Ratings, comments, likes | 9 |
 | [secretary.md](secretary.md) | Doctor secretaries | 5 |
+| [permission.md](permission.md) | Permission catalog — single registry of permissionable resources | 1 |
 | [representation.md](representation.md) | Representations (agents) | 6 |
 | [sms.md](sms.md) | SMS send & templates | 10 |
 | [blog.md](blog.md) | Blog posts | 6 |