feat: honor permissions from .claude/settings.json

[siddhanttiwari19]

Refs #37

Adds a rule-matching layer in front of the existing 3-tier permission model that honors .claude/settings.json (and .claude/settings.local.json, which wins on conflict).

• Maps Bash(...), Edit(...), Read(...), WebFetch(domain:...), and bare tool names onto our internal tool names
• Precedence: deny > ask > allow within imported rules; native config always outranks imported rules
• Unmappable rules are collected and skipped rather than erroring
• Gated behind config.compat.importClaudeSettings (default on); logs a one-line startup summary when rules are loaded
• No .claude/settings.json present → loadClaudeCompatRules returns null and behavior is unchanged

23 new fixture tests in src/permissions/claude-settings.test.ts covering allow/deny/ask, glob patterns (** vs *), precedence, unmappable-rule skip, local-overrides-global, and the no-file no-op case.

bun run typecheck, bun test, bun run build all pass.