feat(config): grant and revoke user permissions on objects

[s31teg]

Summary

When an API user calls /dev/sps/io/<input>/pulse on an object it has no permission entry for, for example a virtual input just added for a webhook, the Miniserver answers Code="403". lox-cli can add users but can't edit their object permissions. This PR adds that.

Commands

lox config user-grant  <FILE> <USER> <OBJECT> [--group] [--act <N>] [--save-as <PATH>]
lox config user-revoke <FILE> <USER> <OBJECT> [--group] [--save-as <PATH>]
lox config user-perms  <FILE> <USER> [--group]
lox config add --type virtual-input --title T <FILE> --grant <USER>
lox config add-virtual-in <FILE> T --grant <USER>

• user-grant appends <PRM REF="<uuid>" ACT="3"/> to the user's <PH> block and updates NUM. It creates the block if needed. --act changes the access value of an existing entry.
• user-revoke removes the entry and drops an emptied <PH>, so a grant followed by a revoke gives a byte-identical file. uuid:<uuid> also revokes entries whose object no longer exists.
• --group edits a user group (same <PH>/<PRM> structure).
• user-perms lists the permitted objects (title, type, ACT, uuid). config users gains a permission count and, with -o json, each user's uuid and resolved permissions.
• --grant <USER> on the two virtual-input commands. add_virtual_in now also returns the VirtualIn's own UUID, which is what PRM REF points at.

Safety

• Users are matched only by exact (case-insensitive) title or uuid:, never fuzzily, so the wrong account can't be edited by accident.
• Objects use the existing element selector and must match exactly one element.
• Repeated grants and revokes are no-ops that leave the file untouched.
• Password hashes (<HP>) and TIM attributes are never touched.

Notes

• Cmd::Config now boxes ConfigCmd, because the extra --grant field tripped clippy's large_enum_variant lint.
• ACT 3 is what Config writes for control access to inputs and blocks. Some Door and Notification entries in real projects use ACT="1"; --act covers those.
• Interactions with other PRs:
  • feat: bump the save stamp on edits and flag silent wiring mistakes in validate #24 changes save_edited() to take &mut ConfigEditor; whichever merges second needs a one-line update at the new call sites.
  • Multi-line notes in CRLF files are only byte-clean on write-back with fix(config_edit): stop write-back from adding CRs to multi-line attributes #22.

Testing

• Unit tests in permissions.rs: grant, idempotent grant, --act update, revoke, revoking a missing object, group grant, ambiguous-object rejection, and grant-then-revoke byte identity on a BOM/CRLF fixture.
• Integration and smoke tests in tests/config_integration.rs and tests/cli_smoke.rs.
• COMMANDS.md, README.md and CHANGELOG.md are updated.
• cargo fmt --check, cargo clippy -- -D warnings, cargo build --release and cargo test pass.
• On a copy of a real 2.4 MB project:
  • granting an API user access to a virtual input changed only <PH NUM> and added one <PRM> line;
  • repeating the grant left the file unchanged, and revoking restored the original bytes;
  • an unknown user and an ambiguous object were rejected without touching the file.