Remove or migrate legacy ConfigFragment permission stubs #47

During multisite/admin plugin cleanup, stale local branch fix/replace-misc-stubs was found. It changed only internal/config.yaml, replacing /api/v1/admin/workflows/{id}/permissions stub routes with SQLite-backed queries against workflow_permissions.

Current state:

• internal/config.yaml is still embedded by ConfigFragment().
• The permissions routes still return [] and 501 permission management not yet implemented.
• No workflow_permissions table exists in current config, so the old branch cannot be ported as-is.
• docs/plans/2026-05-26-admin-dashboard-revival-design.md rejected extending the old config-injection dashboard in favor of admin.dashboard contribution contracts and composed auth/authz.
• Current embedded UI does not call /api/v1/admin/workflows/{id}/permissions.

Needed outcome:
Decide whether internal/config.yaml legacy admin routes are still a supported surface. If yes, add the missing schema and tests before replacing the stub. If no, remove or clearly mark the stale permissions routes so operators do not see a partially implemented admin API.