Add initialize-time server request capabilities so app-server only sends conversational permission confirmation requests to clients that advertise support.
Unsupported clients still fail closed without changing permissions, while capable clients receive the existing request/response flow for narrow grants and preset picker requests.