fix(permissions): keep a failed remote flat-invalidation from crashing the process

The outer.permission.flatInvalidated applier was fire-and-forget with
no catch, and it awaits a KV delete — one transient KV error while
applying a peer region's revoke became an unhandled rejection, which
is process-fatal under default Node. Its sibling appliers were already
guarded; this one now logs and moves on, leaving the entry to the next
invalidation or its TTL, same as a lost event.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/backend/stores/permission/PermissionStore.ts

@@ -119,7 +119,17 @@ export class PermissionStore extends PuterStore {
                 };
                 if (typeof holderUserId !== 'number') return;
                 if (typeof permission !== 'string' || permission === '') return;
-                void this.#applyFlatUserPermDelete(holderUserId, permission);
+                // Guarded: a transient KV error applying a peer's delete must
+                // not become an unhandled rejection. The entry stays until the
+                // next invalidation or its TTL — same as a lost event.
+                this.#applyFlatUserPermDelete(holderUserId, permission).catch(
+                    (err) => {
+                        console.warn(
+                            '[PermissionStore] failed to apply remote flat-perm delete:',
+                            err,
+                        );
+                    },
+                );
             },
         );
     }