web permission system updated

web/CHANGELOG.md

@@ -44,10 +44,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Analytics and import/export use the caller's visible data** — profile-tree
   discovery is authenticated, export is limited to readable tables, and
   import is limited to tables for which the snapshot carries `insert`.
-- **Permission mutations retire the browser session** — the current backend
-  invalidates every existing token after a policy change. After a successful
-  role, assignment, grant or revoke operation the web clears that stale cookie
-  and explains why the administrator must sign in again.
+- **Permission mutations keep the browser session** — grants, role changes and
+  assignments now reload the live authorization state without replacing the
+  identity-only JWT. The permissions workspace reloads in place and shows the
+  updated effective policy.
 - **The column-type picker is the server's list** — it no longer carries its
   own. Types the web crate never offered are now reachable: `numeric` and the
   `ACCOUNTING_TRANSFER` compound column. Server-generated companion types