feat: customizable permissions, per-item Ops ACLs, area-lead roles

Migration 023 (folded into schema.sql section 15). ADDITIVE and
backward compatible: with no permission/ACL rows the app behaves
exactly as before.

Schema:
- space_role_permissions (space_id, subject, permission); ops_acl
  (space_id, entity_type secret|kb|process|area_lead, entity_id,
  role). Full RLS, writes admin/board.
- user_effective_roles(uid,sid): built-in role + custom-role slugs +
  area_lead:<id> for areas the member leads. SECURITY DEFINER.
- user_has_permission(uid,sid,perm): admin implicit-all else a grant
  via an effective role. SECURITY DEFINER.
- secrets/knowledge_base SELECT rewritten as
  `exact existing rule OR ops_acl match` (only widens; zero change
  with no ACL rows). Seed + backfill default role permissions.

Area-lead roles reuse the existing area_leads table rather than
duplicating the concept: a row is a role, lead_id NULL = Vacant,
assigning sets lead_id, the member then holds area_lead:<id>.

App:
- lib/permissions-catalog.ts (codes + per-role defaults + guardrails),
  Zod schemas, lib/actions/permissions.ts (setRolePermissions,
  setOpsAcl, createAreaLeadRole, assign/unassign/delete).
- Customize gains Permissions (role x permission matrix, admin shown
  implicit-all/locked) and Area leads (create/Vacant/assign) panels,
  modular under customize/panels/. Reusable
  components/ops/ops-acl-editor.tsx wired into the Secrets list.

Audit-found latent fixes:
- revealSecret errors on encrypted-but-no-ciphertext corruption
  instead of silently returning the stale plaintext column.
- upsertAreaLead rejects null/empty area_code (NULLs are distinct in
  unique constraints; allowed duplicate rows).

types/database.ts: added the two new tables. 271/271 tests pass,
build clean. KB-modal ACL wiring + members-row shortcut deferred and
tracked in HANDOFF.

app/(app)/customize/customize-client.tsx

@@ -2,22 +2,35 @@
 
 import { useState } from 'react'
 import { RolesPanel } from './panels/roles-panel'
+import { PermissionsPanel } from './panels/permissions-panel'
 import { TiersPanel } from './panels/tiers-panel'
 import { AreasPanel } from './panels/areas-panel'
+import { AreaLeadsPanel } from './panels/area-leads-panel'
 import { InvitesPanel } from './panels/invites-panel'
 import { OnboardingPanel } from './panels/onboarding-panel'
 import type { RoleLabelRow, CustomRole, Tier, Invite, Step, Area } from './panels/types'
 
-type Section = 'roles' | 'tiers' | 'areas' | 'invites' | 'onboarding'
+type Section = 'roles' | 'permissions' | 'tiers' | 'areas' | 'area-leads' | 'invites' | 'onboarding'
 
 const SECTIONS: { key: Section; label: string }[] = [
   { key: 'roles', label: 'Roles' },
+  { key: 'permissions', label: 'Permissions' },
   { key: 'tiers', label: 'Membership tiers' },
   { key: 'areas', label: 'Areas' },
+  { key: 'area-leads', label: 'Area leads' },
   { key: 'invites', label: 'Invite codes' },
   { key: 'onboarding', label: 'Onboarding' },
 ]
 
+interface AreaLead {
+  id: string
+  area_code: string | null
+  area_name: string
+  lead_id: string | null
+  lead_handle: string | null
+  status: string
+}
+
 interface Props {
   isAdmin: boolean
   roleLabels: RoleLabelRow[]
@@ -26,6 +39,9 @@ interface Props {
   invites: Invite[]
   onboardingSteps: Step[]
   areas: Area[]
+  rolePerms: Array<{ subject: string; permission: string }>
+  areaLeads: AreaLead[]
+  members: Array<{ id: string; display_name: string | null; handle: string | null }>
 }
 
 export function CustomizeClient(props: Props) {
@@ -57,8 +73,10 @@ export function CustomizeClient(props: Props) {
 
         <div className="flex-1 min-w-0">
           {section === 'roles' && <RolesPanel isAdmin={props.isAdmin} roleLabels={props.roleLabels} customRoles={props.customRoles} />}
+          {section === 'permissions' && <PermissionsPanel isAdmin={props.isAdmin} customRoles={props.customRoles} rolePerms={props.rolePerms} />}
           {section === 'tiers' && <TiersPanel isAdmin={props.isAdmin} tiers={props.tiers} />}
           {section === 'areas' && <AreasPanel isAdmin={props.isAdmin} areas={props.areas} />}
+          {section === 'area-leads' && <AreaLeadsPanel isAdmin={props.isAdmin} areaLeads={props.areaLeads} members={props.members} />}
           {section === 'invites' && <InvitesPanel isAdmin={props.isAdmin} invites={props.invites} />}
           {section === 'onboarding' && <OnboardingPanel isAdmin={props.isAdmin} steps={props.onboardingSteps} />}
         </div>