Add sentryctl dashboards permissions list|grant|revoke

PUT/DELETE /dashboards/{id}/permissions/{userId} (per-resource dashboard
grants, built earlier this phase) had no caller but Go tests and curl --
named as a real, disclosed gap in docs/phase-4-runbook.md. Adds a CLI
surface: sentryctl dashboards permissions list/grant/revoke, following
the existing dashboards subcommand pattern.

grant/revoke needed a new httpclient.go helper (httpMutateNoBody) since
both endpoints respond 204 No Content -- the existing helpers all expect
a JSON body to pretty-print. grant validates the role client-side
(viewer/editor only, mirroring api/dashboards.validGrantRole) before
making a request, since Admin/Owner already have tenant-wide dashboard
access and a resource-level grant can never raise someone past Editor.

Verified with real httptest.Server round trips (method, path, request
body, and error-body parsing on a 501 from a deployment with no
enterprise permission service wired in) -- the same pattern every other
sentryctl subcommand's tests already use, no fake/mock client needed
since sentryctl itself is just an HTTP client with no store of its own.

cli/cmd/sentryctl/httpclient.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"net/http"
 	"os"
+	"strings"
 	"time"
 )
 
@@ -68,6 +69,47 @@ func httpPostFileJSON(baseURL, path, token, file string, stdout, stderr io.Write
 	return printJSONResponse(resp, stdout, stderr)
 }
 
+// httpMutateNoBody sends method to path with an optional JSON body
+// ("" for none, e.g. DELETE) and expects a 2xx with no meaningful
+// response body -- PUT/DELETE /dashboards/{id}/permissions/{userId}
+// both respond 204 No Content, so there's nothing for printJSONResponse
+// to pretty-print here. Prints successMsg to stdout on success, the
+// same {"error": "..."} parsing every other helper in this file uses
+// otherwise.
+func httpMutateNoBody(method, baseURL, path, token, body, successMsg string, stdout, stderr io.Writer) int {
+	var reqBody io.Reader
+	if body != "" {
+		reqBody = strings.NewReader(body)
+	}
+	req, err := http.NewRequest(method, baseURL+path, reqBody)
+	if err != nil {
+		fmt.Fprintf(stderr, "building request: %v\n", err)
+		return 1
+	}
+	if body != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	setAuth(req, token)
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		fmt.Fprintf(stderr, "request failed: %v\n", err)
+		return 1
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		respBody, _ := io.ReadAll(resp.Body)
+		var errResp errorResponseBody
+		if json.Unmarshal(respBody, &errResp) == nil && errResp.Error != "" {
+			fmt.Fprintf(stderr, "request failed: %s\n", errResp.Error)
+		} else {
+			fmt.Fprintf(stderr, "request failed: status %d\n", resp.StatusCode)
+		}
+		return 1
+	}
+	fmt.Fprintln(stdout, successMsg)
+	return 0
+}
+
 func printJSONResponse(resp *http.Response, stdout, stderr io.Writer) int {
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {