Add first-class exclusion support to permissions

[samkim]

Summary

• Adds exclusions to file, bash, web, and MCP permissions as hard denials (translated into *_excluded relations that subtract from granted in SpiceDB).
• Adds filename-prefix inclusion (basename_prefix) and a snapshot_existing directive that walks the filesystem at apply time to distinguish existing vs newly-created files.
• Fixes the hook server so blanket file_read/file_write/bash/web_fetch/mcp categories now flow through the resource check (exclusions were previously bypassed by the blanket shortcut).

Notable changes

• Schema: new file_path_and_basename_prefix_match and file_path_equals caveats; bare-session grants allowed on every rule type; read_excluded / write_excluded / execute_excluded / fetch_excluded / invoke_excluded relations subtract from both check and *_needs_approval.
• Translator: new FileExclusion/BashExclusion/WebExclusion/MCPExclusion types; Materialize step expands snapshot_existing: true into a paths-kind exclusion; relationship emission handles bare-session grants and every exclusion shape.
• Hook server: categoryHasResource gate on blanket shortcut; grant flow calls Materialize at confirm time so "existing files" means "when the grant was applied".
• Prompt, Describe/Summarize, TUI review screen (nested ↳ except …), and README updated.

Test Plan

• go test ./... — all packages pass (schema, translator, hookserver, tui included)
• go build ./cmd/spicebox — binary builds
• Schema-level coverage for every new caveat, bare-session grant, and subtraction path
• Translator emission tests (basename-prefix inclusion, bare-session blanket, file pattern/paths exclusions, bash/web/MCP exclusions, blanket→resource backfill)
• Materialize unit tests (walks, MaxFiles bound abandon semantics, suffix/basename-prefix filters, no-op)
• Describe tests verifying nested exclusions render + survive FilterPermissions
• Hook-server tests: blanket-with-exclusion honored; grant-time snapshot materialization
• End-to-end integration tests for all 5 exclusion shapes (file basename-prefix, file snapshot, bash prefix, web contains, MCP tool prefix)
• TUI rendering test for ↳ except indented exclusions with collapsed path counts
• Manual TUI smoke test with spicebox claude on a prompt like "read and write Go files under $(pwd) except .env* files"

🤖 Generated with Claude Code