feat: grant a new plugin or connector to everyone by default — the admin's job is now removal, not distribution

The grant junctions (plugin_access, mcp_global_access, mcp_catalog_access)
stay deny-by-default internally, but the rows are written for you at two
moments and never again:

  — an object is CREATED: PluginManager::update_config (first toggle —
    the plugins row's birth), mcp::catalog_upsert, marketplace install,
    mcp::global_enable
  — a user is CREATED: UserManager::register_user

Who is included is the role attrs.auto_grant flag (default true, so every
role predating the attribute behaves like an adult member). The seeded
Children preset sets it to false, which is the whole reason the attribute
exists. Admins are skipped because they hold everything implicitly. The
role editor now exposes the switch as a checkbox.

New crate module: db::access_defaults (seed_new_object, seed_new_user,
set_grant_by_default). Additive columns: grant_by_default on plugins,
mcp_catalog, mcp_global_servers (INTEGER NOT NULL DEFAULT 1).

On the frontend the Roles page gets a "New extensions" column and
checklist; the user's plugin/connector rosters are unchanged. i18n:
en, fr, it.

Docs: new docs/access.md for the assistant, plus index.md cross-link.
CLAUDE.md updated with a full default-access section.

web/i18n/en.js

@@ -700,9 +700,12 @@ export default {
   'roles.col.group':          'Permission group',
   'roles.col.interface':      'Interface',
   'roles.col.assistant':      'Assistant',
+  'roles.col.auto_grant':     'New extensions',
 
   'roles.badge.simple':       'Simple',
   'roles.badge.full':         'Full',
+  'roles.badge.auto_grant_on':  'Automatic',
+  'roles.badge.auto_grant_off': 'On request',
 
   'roles.form.new':           'New role',
   'roles.form.edit':          'Edit {name}',
@@ -721,6 +724,9 @@ export default {
   'roles.form.assistant':        'Default assistant',
   'roles.form.assistant_default': 'Default (Assistant)',
   'roles.form.assistant_hint':   'The agent members of this role chat with by default. Overridable per person later.',
+  'roles.form.auto_grant':       'New plugins and connectors',
+  'roles.form.auto_grant_label': 'Give them to this role automatically',
+  'roles.form.auto_grant_hint':  'When on, a plugin or connector you install reaches this role straight away and you take it back on each person\u2019s page. Turn it off for roles that should only get what you hand them \u2014 children, guests. Existing access is never changed by this switch.',
   'roles.form.attrs':         'Attrs',
   'roles.form.attrs_hint':    '(JSON, optional)',
   'roles.form.attrs_ph':      '{}',

web/i18n/fr.js

@@ -700,9 +700,12 @@ export default {
   'roles.col.group':          'Groupe de permissions',
   'roles.col.interface':      'Interface',
   'roles.col.assistant':      'Assistant',
+  'roles.col.auto_grant':     'Nouvelles extensions',
 
   'roles.badge.simple':       'Simple',
   'roles.badge.full':         'Complet',
+  'roles.badge.auto_grant_on':  'Automatiques',
+  'roles.badge.auto_grant_off': 'Sur demande',
 
   'roles.form.new':           'Nouveau rôle',
   'roles.form.edit':          'Modifier {name}',
@@ -721,6 +724,9 @@ export default {
   'roles.form.assistant':        'Assistant par défaut',
   'roles.form.assistant_default': 'Par défaut (Assistant)',
   'roles.form.assistant_hint':   'L\'agent avec lequel les membres de ce rôle discutent par défaut. Remplaçable par personne plus tard.',
+  'roles.form.auto_grant':       'Nouveaux plugins et connecteurs',
+  'roles.form.auto_grant_label': 'Les attribuer automatiquement à ce rôle',
+  'roles.form.auto_grant_hint':  'Si activé, un plugin ou connecteur que vous installez parvient aussitôt à ce rôle et vous le retirez depuis la page de chaque personne. Désactivez-le pour les rôles qui ne doivent recevoir que ce que vous leur donnez — enfants, invités. Les accès déjà accordés ne sont pas modifiés par cette option.',
   'roles.form.attrs':         'Attributs',
   'roles.form.attrs_hint':    '(JSON, facultatif)',
   'roles.form.attrs_ph':      '{}',

web/i18n/it.js

@@ -700,9 +700,12 @@ export default {
   'roles.col.group':          'Gruppo di permessi',
   'roles.col.interface':      'Interfaccia',
   'roles.col.assistant':      'Assistente',
+  'roles.col.auto_grant':     'Nuove estensioni',
 
   'roles.badge.simple':       'Semplice',
   'roles.badge.full':         'Completa',
+  'roles.badge.auto_grant_on':  'Automatiche',
+  'roles.badge.auto_grant_off': 'Su richiesta',
 
   'roles.form.new':           'Nuovo ruolo',
   'roles.form.edit':          'Modifica {name}',
@@ -721,6 +724,9 @@ export default {
   'roles.form.assistant':        'Assistente predefinito',
   'roles.form.assistant_default': 'Predefinito (Assistente)',
   'roles.form.assistant_hint':   'L\'agente con cui i membri di questo ruolo parlano di default. In futuro sovrascrivibile per persona.',
+  'roles.form.auto_grant':       'Nuovi plugin e connettori',
+  'roles.form.auto_grant_label': 'Assegnali automaticamente a questo ruolo',
+  'roles.form.auto_grant_hint':  'Se attivo, un plugin o connettore che installi arriva subito a questo ruolo e lo togli dalla pagina della singola persona. Disattivalo per i ruoli che devono ricevere solo ci\u00f2 che dai tu \u2014 bambini, ospiti. Gli accessi gi\u00e0 concessi non vengono toccati da questa opzione.',
   'roles.form.attrs':         'Attrs',
   'roles.form.attrs_hint':    '(JSON, opzionale)',
   'roles.form.attrs_ph':      '{}',