feat(dashboard): batch POST /api/permissions for save-all perms (#1719)

docs/web-ui/dashboard.md

@@ -1026,6 +1026,19 @@ that's a browser-level decision, not ours.
   `HIVE_CAPABILITIES` takes effect. Agent name validated;
   unknown capability strings are rejected (400). `guard_agent_name`
   applied.
+- `POST /api/permissions` — batch perm apply for the save-all
+  permissions button. Body
+  `{ changes: [{ agent, tool_groups?: ["name", …], capabilities?: ["name", …] }] }`.
+  Sparse per agent: an omitted field leaves that perm-type untouched,
+  an empty array clears it, a populated array fully replaces it (same
+  replace semantics as the per-agent endpoints above). Each affected
+  agent gets ONE combined `PermChange` queue entry, so changing both
+  an agent's tool-groups and capabilities triggers a single rebuild,
+  not two. **Atomic**: every change is validated first (agent names via
+  `guard_agent_name`, group + capability names) and on any validation
+  error nothing is written or enqueued (non-2xx `{ error }`); rows with
+  both fields omitted are skipped, not errors. Returns `200 "ok"` on
+  success.
 - `GET /api/schedules` — list all schedules (active and
   recently cancelled) for the SCH3DUL3S scheduled-prompts panel.
 - `POST /api/schedules` — operator-direct schedule create: