[zumbrunn]

Closes #27.

Pages contributed to admin.pages were mounted as routes but never listed in the sidebar, although AdminPageRegistration.label is documented as the sidebar label.

• _layout.tsx adds adminContext.pluginPages to the nav items, in a "plugins" group (the layout already renders any non-core group). The existing permission filter hides an entry from anyone without the page's permission.
• The filter needs the user's permissions for those pages, which state.permissions did not have: computeNavPermissions only checks a fixed core list, so a custom permission like billing.manage would have hidden the entry from everyone. It now takes the permissions the contributed pages declare as an extra argument, and the middleware passes them. A permission authz cannot evaluate counts as denied, so one bad plugin name cannot break every admin page; a core permission failing still throws.
• AdminState.permissions and NavItem.permission are now plain strings (a contributed page's permission is a plain string).
• icon is accepted but not rendered: the sidebar shows labels only, core items included. The doc comment says so.

Tests: four new ones (shown with the permission / hidden without / only permitted pages / no empty "plugins" group; extra permissions checked once; an authz error on a custom permission is denied). deno task check clean, full suite 309 pass.

Patch release material (4.0.1). Like 4.0.0 it needs the dependency-age escape flag until the window clears.

🤖 Generated with Claude Code