Read the IAM vocabularies the console renders (permission resources + policy services)

Serves the IAM vocabulary the console used to hard-code: the permission-matrix resource keys the role editor renders a column per. It is static for the life of a deployment — derived from committed backend source of truth, not from tenant data — so a client may cache the response indefinitely and refetch only on reload. permissionResources is exactly iam/permission_matrix.json's resourceKeys, IN THAT ORDER, with a display label and grouping attached server-side; permissionLevels is that file's levels. The contract file has exactly one author (the Go auth service generates it and it is copied verbatim), so serving it here removes the client's undeclared copy rather than adding yet another one — a backend test fails if the served list and the contract file diverge. Validation: scopeId must resolve to a scope the caller can access (unknown or unauthorized → 404 NOT_FOUND, per the 404-not-403 rule). Async & state: Synchronous read; no state change. Errors: 401 when the session/credential is missing or expired; 404 when scopeId does not resolve or the caller has no IAM read on it; 500 on unexpected backend failure. Idempotency/Concurrency: Safe and cacheable; no idempotency key required. The response is identical for every caller in every scope of a given deployment.