fix: update API key permissions for Immich v3 granular permissions

Immich v3 split album-membership rights out of album.update into
albumAsset.create / albumAsset.delete, and assigning tags to assets
requires tag.asset. The hardcoded WORKFLOW_PERMISSIONS list predates
this, so auto-generated workflow keys 403 at runtime on Add to Album
(and Add Tag) actions:

    Immich API error 403: {"message":"Missing required permission: albumAsset.create"}

Also, validate-api-key.ts literal-matched required permissions against
the key's permission list, so a key created with the "All" checkbox
(stored as ["all"]) failed validation for every permission — and the
settings page refuses to save a key that fails validation, making it
impossible to work around with a full-permission key.

- Add albumAsset.create, albumAsset.delete, tag.asset to
  WORKFLOW_PERMISSIONS (matching the endpoints actionExecutor.ts
  actually calls: PUT/DELETE /albums/:id/assets, PUT /tags/:id/assets)
- Add albumAsset.create to IMPORT_PERMISSIONS for the same reason
- Treat a granted "all" permission as satisfying all requirements in
  validate-api-key.ts

Follow-up to #294.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/config/permissions.ts

@@ -8,7 +8,8 @@ export const IMPORT_PERMISSIONS: Permission[] = [
   { name: "asset.upload", description: "Upload new assets" },
   { name: "album.read", description: "Read album data" },
   { name: "album.create", description: "Create new albums" },
-  { name: "album.update", description: "Add assets to albums" },
+  { name: "album.update", description: "Update album metadata" },
+  { name: "albumAsset.create", description: "Add assets to albums" },
   { name: "tag.create", description: "Tag imported assets" },
   { name: "tag.asset", description: "Assign tags to assets" },
 ];
@@ -18,8 +19,11 @@ export const WORKFLOW_PERMISSIONS: Permission[] = [
   { name: "asset.update", description: "Favorite, archive, update metadata" },
   { name: "album.read", description: "Read album data" },
   { name: "album.create", description: "Create new albums" },
-  { name: "album.update", description: "Add/remove assets from albums" },
-  { name: "tag.create", description: "Create and assign tags" },
+  { name: "album.update", description: "Update album metadata" },
+  { name: "albumAsset.create", description: "Add assets to albums" },
+  { name: "albumAsset.delete", description: "Remove assets from albums" },
+  { name: "tag.create", description: "Create tags" },
+  { name: "tag.asset", description: "Assign tags to assets" },
 ];
 
 export const getPermissionNames = (permissions: Permission[]): string[] =>

src/pages/api/settings/validate-api-key.ts

@@ -30,7 +30,11 @@ export default async function handler(req: NextApiRequest, res: NextApiResponse)
 
     const keyData = await keyRes.json();
     const granted: string[] = keyData.permissions ?? [];
-    const missing = REQUIRED_PERMISSIONS.filter((p) => !granted.includes(p));
+    // A key created with the "All" checkbox reports its permissions as ["all"],
+    // which grants every permission without listing them individually.
+    const missing = granted.includes("all")
+      ? []
+      : REQUIRED_PERMISSIONS.filter((p) => !granted.includes(p));
 
     return res.status(200).json({
       valid: missing.length === 0,