fix(permissions): resolve grant scope by catalog scopeField; numeric scope escape hatch

[2000game]

Summary

ct adopt grants group_type_role 9 against real prod data (issue #49) returned 27 live grants, 10 of which are scoped churchdb rights (churchdb:view comments, churchdb:security level view own data, churchdb:security level edit own data) scoped to dataIds 1, 2, 3, 5. src/permissions/adopt.ts assumed every scoped dataId is a group (findByTypeId(state, "group", id)) and told you to ct adopt group <id> — but GET /groups/{1,2,3,5} 404s, because those dataIds aren't groups: the rights' catalog scopeField is cc_securitylevel / cdb_comment_viewer, a different ChurchTools dimension. The resulting partial adoption block couldn't express those grants, so applying it would revoke live grants — blocking plan-to-no-op on a real instance. There was also no way to declare a known non-group dataId in the DSL at all (scope only accepted logical group keys).

This PR implements all three requirements from the issue:

1. Scope resolution now follows the right's actual scopeField. Only rights whose scopeField is the group dimension ("cdb_gruppe") are resolved/round-tripped as logical group refs (src/permissions/adopt.ts). Every other scope dimension passes through numerically.
2. Numeric scope escape hatch in the DSL (src/permissions/scope.ts, src/permissions/types.ts, src/config/context.ts): a scope array entry may now be a raw positive-integer number alongside logical group keys — validated at eval time, resolved with no state lookup, and (correctly) never retains a scopeKey for re-resolution at apply time, since its dataId is already final.
3. ct adopt grants emits the numeric form and names the scope dimension for any scoped right whose scopeField isn't the group dimension — always as an active, paste-ready grant line, never a ct adopt group #N hint for a dataId that was never a group. The existing ct adopt group <id> hint is preserved unchanged for genuinely unmanaged group-scoped dataIds.

Test plan

• Unit tests added first (TDD), covering:
  • resolveScope numeric entries (pass-through, sorting, validation of non-positive/non-integer values) — tests/permission-scope.test.ts
  • desiredTuples numeric scope entries (no scopeKey retained, mixable with logical keys) — tests/permission-plan.test.ts
  • DSL validation accepting (string | number)[] scope arrays and rejecting invalid entries — tests/context.test.ts
  • emitAdoptedGrants: non-group scope dimensions emit the numeric form as an active grant (never a WARNING or ct adopt group hint), a regression test locking the unchanged group-dimension behavior, and a full round-trip repro of the issue's exact scenario (churchdb:security level view/edit own data scoped to dataIds 1,2,3,5) asserting diffGrants produces zero toPut and zero toDelete — tests/permission-adopt.test.ts
• npm test — 354 passed, 4 skipped (0 failures)
• npm run typecheck — clean
• npm run lint — clean
• npm run build — sanity build succeeds

Never hits a live instance or requires credentials — all fixtures are inline RawPermission[] rows.

Closes #49