A conceptual complement to PERMISSION_FE_REFACTOR_GUIDE.md: explains how the
new grant-based permission system is wired on the frontend and the design
decisions behind it (why resourceId is always passed, why every UI action
gets its own getCan method, why permission logic lives in stores and components
consume booleans via props, how the three stores split responsibility).
Covers the grant model, end-to-end type safety, the three stores
(PermissionAccessStore / RoleManagementStore / PermissionSchemeStore),
per-entity permission instances, top-level prop assembly, the access
composition hooks in apps/web/core/hooks/permissions/ for sidebar/route
gating, conditional checks (creator/lead), lifecycle, and a cheat sheet.
