Make the admin-tier group grants a configurable default (disable / remap) #139

Problem

Since #132, core grants editing rights to the three admin-tier groups on app:site at group level. bootstrapRoleGrants (src/auth/authz.ts) loops over a hardcoded ["admin", "editor", "author"] and writes group:<role> → <role> on SITE_RESOURCE. The intent was an out-of-the-box default, but nothing can change it:

• no config key names, remaps or disables the groups;
• the grant tuples are re-seeded at every start, so deleting one by hand does not stick;
• a site that uses editor or author as a content tier (for example a membership level) gets site-wide editing for those users on upgrade, and can only avoid it by renaming its own roles.

Group membership is derived from each user's roles[], so the only lever a dev has today is not assigning those role names.

Proposal

Make the grants a default that config can change.

• A mapping of group → relation, defaulting to today's admin: admin, editor: editor, author: author.
• Devs can set it to {} to turn the group-level grants off, remap their own group onto an existing relation (for example staff: editor), or keep a subset.
• The relations themselves stay admin / editor / author: they are part of the authz schema and plugins cannot add new ones. Config chooses which group gets which relation.
• The bootstrap must reconcile, not only add: today it writes a tuple if it is missing, so a grant written by an earlier run would keep applying after a dev removes it from config. Grants the bootstrap owns and that are no longer configured need to be revoked.
• Docs (authorization page, payments and external-jwt pages) describe these as defaults and show how to change them. The auth.automatic_admin_tier_grant log and the dune doctor --boot access line from feat(plugin-api)!: core gates /api/inline-edit/*; typed capability keys replace declaration merging #134 keep working and should reflect the configured mapping.

Context

• Behaviour introduced in fix(authz)!: site users' roles grant editing, checked on app:site; roles apply without a restart (#130) #132 (closes Inline editing for a signed-in site user is denied whenever the admin plugin did not set up authz or the app:admin tuples #130); safeguards in feat(plugin-api)!: core gates /api/inline-edit/*; typed capability keys replace declaration merging #134; docs in docs: snake_case config keys, removed deprecations and plugin services (0.36) dune-docs#22.
• Not a security vulnerability: it needs a dev to assign an admin-tier role to a user. It is an upgrade foot-gun and a missing override for a default.
• Not a blocker for the 0.36 stack, but it changes the shape of the config the stack documents, so worth deciding before 0.36 ships.