A2: retire the per-app grant layer (nav resolver + page-grant middleware)

Removes this app's NavVisibilityRegistry resolver and, where it had one, its
page-grant middleware. Sidebar visibility and route access now come from the
same place as everything else: a permission, held through a group.

Nav visibility already had a better answer than the resolvers. NavItem::
visibleTo() applies required_permission to any route prefix that is NOT
registered — central-notifications documents exactly that and is why it never
registered one — and HandleInertiaRequests then applies a safety net reading
the TARGET route's own `permission:` middleware. The resolvers were overriding
both with a lookup against a grant table that is now empty, so a permission
holder could open a page while its sidebar link stayed hidden. That
inconsistency is what this removes.

The middleware only ever NARROWED routes that already carry `permission:`,
with one exception worth naming: payments' legacy rule had NO permission
bypass, so a payments.view holder was denied the ledger it gates. Deleting it
fixes that rather than changing it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RDA3fQbsa3gaHCFoV1Q8Gg

src/UnifiServiceProvider.php

@@ -43,17 +43,6 @@ class UnifiServiceProvider extends ServiceProvider
         // groups, plus pages granted via the Settings → Access tab. The
         // shell also folds these grants back into User::can()/allPermissions
         // so the route-level permission middleware passes for grantees.
-        try {
-            app(\App\Support\NavVisibilityRegistry::class)->register(
-                'unifi.',
-                fn (\App\Models\User $user) => $this->visibleUnifiNavItemIdsFor($user),
-            );
-        } catch (\Throwable) {
-            // Shell may not have the registry yet (older shell version).
-            // Sidebar will fall back to legacy permission filter.
-        }
-
-
         if ($this->app->runningInConsole()) {
             $this->commands([
                 Console\CheckWebhooks::class,