feat(tui): preselect scoped permission requests

Enable `request_permissions_tool` by default and add a scope hint so
conversational requests for named paths can open the permissions UI with
the requested duration selected.

Thread the suggested scope through protocol, core, app-server, and TUI
handling so broad mode changes still use the preset picker while narrow
filesystem and network grants use the granular permissions flow.

codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalParams.json

@@ -39,6 +39,13 @@
       },
       "type": "object"
     },
+    "PermissionGrantScope": {
+      "enum": [
+        "turn",
+        "session"
+      ],
+      "type": "string"
+    },
     "RequestPermissionProfile": {
       "additionalProperties": false,
       "properties": {
@@ -79,6 +86,14 @@
         "null"
       ]
     },
+    "suggestedScope": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/PermissionGrantScope"
+        }
+      ],
+      "default": "turn"
+    },
     "threadId": {
       "type": "string"
     },