web synchronized with the new changes

web/CHANGELOG.md

@@ -16,6 +16,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Added
 
+- **Role, user and permission administration** — `/admin/permissions` consumes
+  `ListRoles`, `AddRole`, `RemoveRole`, `ListUsers`, `AssignUserRole`,
+  `ListRolePermissions`, `ListGrantableObjects`, `GrantPermission` and
+  `RevokePermission`. Direct and inherited grants are distinguished, and the
+  action controls come from each grantable object returned by the backend.
+- **Table-family permissions in table definition** — selecting a table shows
+  its grant matrix for every editable data role. Creating a table redirects to
+  that table in the definition workspace so its initial grants can be assigned
+  immediately.
+- **Bootstrap administrator claim** — `/initial-password` consumes
+  `SetInitialPassword` for the one-time `admin` and `superadmin` setup flow.
 - **`TableDefinition.ListColumnTypes`** — called by the add-table and
   table-definition loaders. The whole response is consumed: `name`, `group`,
   `declarable`, `compound`, `spelling`, `requires_currency`, `creation_only`,
@@ -25,6 +36,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Changed
 
+- **Web authorization follows permission objects, not role names** — structural
+  pages check their `struct:<area>/manage` permission from `GetAuthorization`,
+  so inherited `superadmin` authorization works and data roles are no longer
+  treated as administrators. Login redirects structural users to the admin
+  workspace and data users to analytics.
+- **Analytics and import/export use the caller's visible data** — profile-tree
+  discovery is authenticated, export is limited to readable tables, and
+  import is limited to tables for which the snapshot carries `insert`.
+- **Permission mutations retire the browser session** — the current backend
+  invalidates every existing token after a policy change. After a successful
+  role, assignment, grant or revoke operation the web clears that stale cookie
+  and explains why the administrator must sign in again.
 - **The column-type picker is the server's list** — it no longer carries its
   own. Types the web crate never offered are now reachable: `numeric` and the
   `ACCOUNTING_TRANSFER` compound column. Server-generated companion types
@@ -59,13 +82,6 @@ The endpoints and fields below are part of the current proto surface but the
 web crate does not implement them. They are listed so it stays visible what
 the backend gained that this client has not wired up yet.
 
-- **`AuthService` role administration** — `SetInitialPassword`, `ListRoles`,
-  `AddRole`, `RemoveRole`, `GrantPermission`, `RevokePermission`,
-  `ListRolePermissions`, `ListGrantableObjects`, `AssignUserRole` and
-  `ListUsers` are not called by any page; there is no role-administration UI.
-  `GetAuthorization` still reads only `role` — the reworked `Permission`
-  object/action surface (structural areas, `data:`/`journal:` objects) is
-  ignored.
 - **`TableDefinition.PostTableDefinition` — `LINK(table)` columns** — the old
   per-request link UI was removed when links became columns, and the new
   spelling is not implemented. The picker offers `link` (the `ListColumnTypes`