feat: validate required SSH permissions before creating server

- New server_permissions table (migration 007) stores required SSH permissions per server
- PermissionValidator service connects via SSH and validates each permission before save
- ServerPermission model for CRUD on server_permissions table
- Web flow: create/edit forms include dynamic permission rows with quick-add presets
- API flow: serverAdd/serverUpdate accept permissions array, return 400 on failure
- Show view displays required permissions on server detail page
- Form input preserved on validation failure (credentials excluded)
- AGENTS.md updated with new conventions

public/assets/css/style.css

@@ -3071,3 +3071,65 @@ textarea.form-input {
     font-weight: 500;
     color: var(--text-secondary);
 }
+
+/* --- Server permission rows --- */
+.permission-row {
+    display: flex;
+    gap: 0.5rem;
+    align-items: center;
+    margin-bottom: 0.5rem;
+    padding: 0.5rem;
+    background: var(--bg-secondary, #f8f9fa);
+    border-radius: 6px;
+    border: 1px solid var(--border-color, #e0e0e0);
+}
+
+.permission-row .permission-type {
+    flex: 0 0 160px;
+}
+
+.permission-row .permission-value {
+    flex: 1 1 auto;
+}
+
+.permission-row .permission-desc {
+    flex: 0 0 200px;
+}
+
+.permission-row .btn-danger {
+    flex: 0 0 auto;
+}
+
+.permission-actions {
+    margin-top: 0.5rem;
+}
+
+.permission-presets {
+    margin-top: 0.75rem;
+    display: flex;
+    align-items: center;
+    gap: 0.4rem;
+    flex-wrap: wrap;
+}
+
+.permission-presets .preset-label {
+    font-size: 0.8rem;
+    color: var(--text-muted, #888);
+    margin-right: 0.25rem;
+}
+
+.btn-outline {
+    background: transparent;
+    border: 1px solid var(--border-color, #ccc);
+    color: var(--text-primary, #333);
+    padding: 0.25rem 0.6rem;
+    font-size: 0.8rem;
+    border-radius: 4px;
+    cursor: pointer;
+    transition: all 0.15s;
+}
+
+.btn-outline:hover {
+    background: var(--bg-hover, #e9ecef);
+    border-color: var(--text-muted, #888);
+}