Phase 2: Hook permission tiers into the agent pipeline.

New methods on GatewayRunner:
- _resolve_user_tier(source) -> str: user -> default_tier -> 'admin'
- _get_tier_config(tier_name) -> Optional[TierDefinition]
- _get_tier_allowed_toolsets(tier_name) -> List[str]
- _is_within_time_window(tier) -> (bool, Optional[str])

Hooks:
- In _run_agent(): intersect enabled_toolsets with tier-allowed list
- In _agent_config_signature(): include user_tier for cache isolation
- Inject tier system prompt into combined_ephemeral (soft enforcement)

All paths are opt-in: if permission_tiers is None, no filtering occurs.

…ands

Phase 3: Exec approval gating
- /approve and /deny handlers check allow_exec permission
- Approval hint suppressed for users without exec permission
- Uses _format_tier_message() for i18n denial response

Phase 4: Time restriction early gate
- _handle_message() checks time window before agent dispatch
- Users outside allowed hours get localized denial message
- Cross-midnight windows and day-of-week filters supported

Phase 5: Admin slash command restrictions
- /model, /provider, /update, /reload-mcp, /config gated by allow_admin_commands
- Safe commands (/new, /reset, /help, /status) always allowed
- Check happens after alias resolution, before handler dispatch

Documents the implemented permission tier system:
- Architecture diagram and config schema
- All 6 phases with actual code patterns (not planned)
- Design decisions and rationale
- Test coverage summary (45 tests)
- Sample config for onboarding
- Commit history and diff stats

…strictions

- _resolve_user_tier() validates tier exists in config; falls back to
  default_tier on typos (fail-closed, not fail-open)
- _is_within_time_window() wraps HH:MM parsing in try/except for
  ValueError/TypeError; validates 0-1439 minute range
- Both guards log warnings and allow access (fail-open for time,
  fail-closed for tier resolution)

4 new tests: typo tier fail-closed, cascade to admin, user_id=None,
  invalid time format.

PermissionTiersConfig.from_dict() now auto-injects TierDefinition entries
for any tier name referenced by default_tier or users but missing from
the tiers dict. Injected tiers are permissive (allow_exec=True,
allowed_toolsets=[*]) as a safe fallback.

This closes the theoretical edge case where all three fallback levels
(user tier, default_tier, admin) could return a name not in tiers,
causing _get_tier_config() to return None and bypass all restrictions.

Phase 5 — Type validation hardening:
- H5: coerce bool/string types in TierDefinition.from_dict()
- M8: handle allowed_toolsets: null gracefully
- M7: invalid days values produce empty list (always blocked)
- M9: catch AttributeError in time parsing

Phase 6 — Quick command and approval hardening:
- H6: gate quick exec commands behind allow_exec
- M11: key pending approvals by (session_key, user_id) to prevent
  cross-user approval in shared sessions

Phase 7 — Config boundary hardening:
- M10: warn when permission_tiers block has no tiers defined
- L4: runtime tier fallback uses most-restrictive tier, not admin
- L5: UserTierConfig.tier defaults to None, not admin

Phase 8 — Documentation:
- update user mapping docs for null tier default
- add platform ID reference table with stability notes
- add troubleshooting for type coercion, days behavior, quick exec,
  approval isolation, and empty config blocks

88 tier tests passing. 6538 project tests passing. 0 regressions.