feat(tui): preselect scoped permission requests

Enable `request_permissions_tool` by default and add a scope hint so
conversational requests for named paths can open the permissions UI with
the requested duration selected.

Thread the suggested scope through protocol, core, app-server, and TUI
handling so broad mode changes still use the preset picker while narrow
filesystem and network grants use the granular permissions flow.

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -3359,6 +3359,14 @@
             "null"
           ]
         },
+        "suggestedScope": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PermissionGrantScope"
+            }
+          ],
+          "default": "turn"
+        },
         "threadId": {
           "type": "string"
         },