feat(tui): preselect scoped permission requests

Enable `request_permissions_tool` by default and add a scope hint so
conversational requests for named paths can open the permissions UI with
the requested duration selected.

Thread the suggested scope through protocol, core, app-server, and TUI
handling so broad mode changes still use the preset picker while narrow
filesystem and network grants use the granular permissions flow.

codex-rs/app-server-protocol/schema/json/ServerRequest.json

@@ -1409,6 +1409,13 @@
         }
       ]
     },
+    "PermissionGrantScope": {
+      "enum": [
+        "turn",
+        "session"
+      ],
+      "type": "string"
+    },
     "PermissionPresetId": {
       "enum": [
         "auto",
@@ -1481,6 +1488,14 @@
             "null"
           ]
         },
+        "suggestedScope": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PermissionGrantScope"
+            }
+          ],
+          "default": "turn"
+        },
         "threadId": {
           "type": "string"
         },