feat(app-server): add permission request capabilities

Add the `supportedServerRequests` initialize capability across the
app-server protocol, clients, and connection session state. This lets
surfaces explicitly advertise which conversational permission approval
requests they know how to receive.

Keep this branch limited to the opt-in contract and the bookkeeping
needed to store that capability per connection. Delivery and UI handling
stay in later stacked PRs so existing clients remain backward
compatible and the review surface stays small.

codex-rs/app-server-protocol/schema/json/ClientRequest.json

@@ -1022,6 +1022,16 @@
             "array",
             "null"
           ]
+        },
+        "supportedServerRequests": {
+          "description": "Server request methods this connection knows how to render and answer.",
+          "items": {
+            "$ref": "#/definitions/SupportedServerRequestMethod"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
         }
       },
       "type": "object"
@@ -2569,6 +2579,14 @@
       },
       "type": "object"
     },
+    "SupportedServerRequestMethod": {
+      "description": "Server-initiated request methods a client can opt into during initialize.",
+      "enum": [
+        "item/permissions/requestApproval",
+        "item/permissionPreset/requestApproval"
+      ],
+      "type": "string"
+    },
     "TextElement": {
       "properties": {
         "byteRange": {