security: add scope checks to AI Patrol and agent profile endpoints

- AI Patrol mutation endpoints (acknowledge, dismiss, suppress, snooze, resolve,
  findings/note, suppressions/*) now require ai:execute scope to prevent
  low-privilege tokens from blinding patrol by hiding/suppressing findings

- Agent profile admin endpoints (/api/admin/profiles/*) now require
  settings:write scope to prevent low-privilege tokens from modifying
  fleet-wide agent behavior

pkg/auth/permissions.go

@@ -15,4 +15,6 @@ const (
 	ResourceNodes     = "nodes"
 	ResourceUsers     = "users"
 	ResourceLicense   = "license"
+	ResourceAI        = "ai"
+	ResourceDiscovery = "discovery"
 )