Migrate all product APIs from local StaffAuth copy to ferrlabs-permissions

[BryanFRD]

Context

FerrLabs/Kit#30 shipped the ferrlabs-permissions crate (typed Scope enum, StaffAuth extractor, capability checks) and FerrLabs-Cloud was migrated. Every other product API still carries a local copy of StaffAuth that was forked before the crate existed.

Each local copy is debt:

• Same auth bugs (JWKS timeout, OAuth code-replay revoke, etc.) need to be patched N times.
• The introspection HTTP call to FerrLabs-Cloud /v1/auth/introspect is duplicated.
• Local copies drift from the canonical implementation.

Adoption matrix (as of audit)

Repo	ferrlabs-permissions dep	Local pub struct StaffAuth
FerrLabs-Cloud	✓	✓ (source of truth — keep)
FerrFleet-Cloud	partial (dep added, code not migrated)	✓
FerrVault-Cloud	✗	— (uses different auth path)
FerrTrack-Cloud	✗	—
FerrGrowth-Cloud	✗	—
FerrLens-Cloud	✗	— (Astro SSR proxies to FerrLabs-Cloud)

Sub-issues to spawn

• FerrLabs/FerrFleet-Cloud — finish migration (dep is there, swap extractor)
• FerrLabs/FerrVault-Cloud — adopt ferrlabs-permissions
• FerrLabs/FerrTrack-Cloud — adopt ferrlabs-permissions
• FerrLabs/FerrGrowth-Cloud — adopt ferrlabs-permissions
• FerrLabs/FerrLens-Cloud — adopt ferrlabs-permissions (only if it grows its own auth surface)

Each is a ~30-min mechanical PR. Mark chore(api): — no behavior change.