audit F51 [UX]: state.rs builds permission strings via format!("{p:?}")

[intendednull]

File: crates/web/src/state.rs:867
Severity: UX
Obvious? no

Permission::Debug prints variant names like SyncProvider, ManageChannels. These are then displayed in role lists. Debug is a non-stable string for UI; a Display impl on Permission would let UX evolve without grepping state.rs.

Today this is fine but a small CamelCase-to-readable shim would help i18n later.

Fix: add impl Display for Permission returning user-facing strings; switch UI render path to {p}.

---

Filed by /general-audit @ b901575 (2026-05-02). master: #513.