feat(list): report the access One enforces for this key (v2.5.0)

[krish221997]

feat(list): report the access One enforces for this key, from GET /v1/access/me (v2.5.0)

one list used to compute each connection's access from the local
config only, which says full access unless one config narrowed it —
so a key the consent page limited to Read only, Read & write or a few
actions was still reported as full. It now asks One:

• GET /v1/access/me (pica-v2 #958) answers the key's own rules: null
  (unrestricted), rules: null (+ key-wide methods), rules: [] (no
  connection: knowledge only), or one rule per connection (methods,
  actionIds). Read exactly as the server's checker reads them.
• The CLI's own one config limits still apply, and can only narrow.
• Each connection's access gets a level named like the consent page:
  full, read-write, read-only, custom, none (human table: Full access,
  Read & write, Read only, the actions, No access).
• accessSource: "server" | "local". When the API can't answer (today's
  production, before #958 ships), the CLI says so — column "Access (CLI
  settings only)" and an accessHint — instead of claiming full access.

Verified end to end on a local pica-v2 built from main: keys minted and
narrowed with the same calls the CLI consent page makes (personal and
organization), every rule shape, and refusals (403) on writes outside
the grant match what one list shows.

Tests: 20 new (rule shapes, local narrowing, client call). Full suite
661: 655 pass; the 6 failures are the pre-existing resolveConfig macOS
tmpdir cases, identical on main.

Depends on withoneai/pica-v2#958 being deployed; until then the CLI falls back and says so.

🤖 Generated with Claude Code