Add the get_permissions plugin hook (contract 0.10.0)

Plugins declare their own RBAC permissions instead of core accumulating
them: 36 permissions moved out of the core catalog into the 9 owning
plugins (core keeps the 19 its own blueprints enforce). The catalog is
resolved dynamically (core + enabled plugins) and feeds the roles grid,
the token scope picker and ceiling, and flask seed permissions;
installing or enabling a plugin seeds its permissions automatically. A
disabled plugin drops out of the assignable catalog while existing role
links keep working. New plugins - bundled or external - now bring their
permissions with zero core edits.

781 tests pass; live-verified with a machines.edit-scoped token.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

shopdb/__init__.py

@@ -27,7 +27,12 @@ from .plugins import plugin_manager
 # (resolve_dualpath_pairs, dualpath_single_machine_enabled), consumed by the
 # machines plugin list/detail to collapse dual-bay pairs. Two additive names,
 # minor bump.
-__contract_version__ = '0.9.0'
+# 0.10.0: added the get_permissions hook so a plugin declares the RBAC
+# permissions its own routes enforce, instead of core accumulating them in one
+# catalog. Consumed by full_permission_catalog() (core + enabled plugins),
+# which backs seeding, the role grid, and API-token scope validation. Additive
+# optional hook, minor bump.
+__contract_version__ = '0.10.0'
 
 # Product release version (see ADR-007). The product version and the
 # plugin-contract version above are distinct series with independent