fix(roles): reflect & preserve wildcard tool grants in the role editor

[AriOliv]

Problem

The organization role editor (Settings → Roles → MCP Permissions) renders a connection's tools as unchecked even when the role already grants them, and re-saving destroys the grant.

convertRoleToFormData expands a stored ["*"] (all-tools) grant into concrete names via conn.tools:

toolSet[key] = tools.includes("*") ? (conn.tools?.map((t) => t.name) ?? []) : tools;

But the connection list endpoint (COLLECTION_CONNECTIONS_LIST) omits tools — the editor fetches them lazily per selected connection. So conn.tools is undefined, the grant expands to [], and:

• every tool renders unchecked (0/N) even though the role grants them, and
• saving writes [] back → buildPermission drops the entry → the grant is destroyed.

Grants for connections not present in the current (paginated) list were likewise dropped on load.

Fix

• convertRoleToFormData preserves the raw grant, including the "*" sentinel, and no longer drops grants for connections missing from the current page.
• ToolSetSelector understands "*" as "all tools" for checked state, the N/N count, and both per-tool and per-connection toggles (toggling a single tool off first expands "*" to concrete names so the rest stay selected).
• buildPermission already collapses a fully-selected connection back to ["*"], so grants round-trip cleanly.

Testing

• tsc --noEmit on apps/web passes.
• A role that grants all of a connection's tools (stored ["*"]) now reopens fully checked instead of 0/N, and survives a re-save instead of being wiped.

🤖 Generated with Claude Code