feat(equipment): schema + RLS + permission (data layer)

Migration 033 adds equipment (registry; status, optional
required_certification_id, is_active archive) and equipment_reservations
(member time-window reservation; denormalized space_id). RLS is additive
and default-deny: equipment readable by managers (all) or members
(active only), reservations by managers (all) or the member (own) with
manager-only UPDATE and no INSERT/DELETE policy so reserve/cancel
funnels through a validated service-client action (status, no-overlap
and required-certification enforced there, with manager override). New
equipment.manage permission (group Equipment) seeded to board and
backfilled. Mirrored idempotently in schema.sql; types and schema docs
updated.

lib/permissions-catalog.ts

@@ -26,6 +26,7 @@ export const PERMISSIONS = [
   { code: 'certifications.grant',  group: 'Certifications', label: 'Award and revoke certifications (Instructor)' },
   { code: 'classes.manage',     group: 'Classes', label: 'Manage classes and schedule sessions' },
   { code: 'classes.instruct',   group: 'Classes', label: 'Run classes: attendance, completion, attendees' },
+  { code: 'equipment.manage',   group: 'Equipment', label: 'Manage equipment and reservations' },
   { code: 'customize.manage',   group: 'Admin', label: 'Customize roles, tiers, areas, invites, onboarding' },
   { code: 'settings.manage',    group: 'Admin', label: 'Space settings, integrations, webhooks' },
 ] as const
@@ -47,6 +48,7 @@ export const DEFAULT_ROLE_PERMISSIONS: Record<string, PermissionCode[]> = {
     'forum.moderate', 'forms.manage',
     'certifications.manage', 'certifications.grant',
     'classes.manage', 'classes.instruct',
+    'equipment.manage',
     'customize.manage', 'settings.manage',
   ],
   treasurer: ['payments.manage', 'ops.kb.read', 'ops.process.read'],