Add sentryctl dashboards permissions list|grant|revoke

PUT/DELETE /dashboards/{id}/permissions/{userId} (per-resource dashboard
grants, built earlier this phase) had no caller but Go tests and curl --
named as a real, disclosed gap in docs/phase-4-runbook.md. Adds a CLI
surface: sentryctl dashboards permissions list/grant/revoke, following
the existing dashboards subcommand pattern.

grant/revoke needed a new httpclient.go helper (httpMutateNoBody) since
both endpoints respond 204 No Content -- the existing helpers all expect
a JSON body to pretty-print. grant validates the role client-side
(viewer/editor only, mirroring api/dashboards.validGrantRole) before
making a request, since Admin/Owner already have tenant-wide dashboard
access and a resource-level grant can never raise someone past Editor.

Verified with real httptest.Server round trips (method, path, request
body, and error-body parsing on a 501 from a deployment with no
enterprise permission service wired in) -- the same pattern every other
sentryctl subcommand's tests already use, no fake/mock client needed
since sentryctl itself is just an HTTP client with no store of its own.

cli/cmd/sentryctl/main.go

@@ -55,6 +55,9 @@ Usage:
   sentryctl ping [--api <url>]
   sentryctl query "<query>" [--api <url>] [--language sql|spl] [--json]
   sentryctl dashboards list|get <id>|apply <file> [--api <url>]
+  sentryctl dashboards permissions list <dashboard-id> [--api <url>]
+  sentryctl dashboards permissions grant <dashboard-id> <user-id> viewer|editor [--api <url>]
+  sentryctl dashboards permissions revoke <dashboard-id> <user-id> [--api <url>]
   sentryctl alerts list|get <id>|apply <file> [--alerting-api <url>]
 
 Commands:
@@ -67,6 +70,12 @@ Commands:
               "apply <file>" imports a dashboard exported via the web
               UI's Export JSON button or GET /dashboards/{id}/export --
               the same JSON shape both places, Terraform-friendly.
+              "permissions" grants/revokes/lists per-resource dashboard
+              access (a Phase 4, enterprise-api-only feature -- a 501 on
+              plain api means no enterprise permission service is wired
+              in on this deployment, not a client error). A grant only
+              ever raises someone to viewer or editor on one dashboard;
+              Admin/Owner already have tenant-wide access.
   alerts      list/get/apply against alerting's rule CRUD endpoints.
               "apply <file>" creates a rule from a JSON file with the
               same shape POST /rules accepts.