Wire action-group variables, sudo, and command path resolution through the API and UI.

Completes run-if/set_variable and requires_sudo editing, sudoers path resolve helpers, and execute permission checks so node action groups can gate upgrades and elevate safely.

service/internal/api/groups_handlers.go

@@ -22,19 +22,20 @@ type upsertGroupRequest struct {
 }
 
 var allowedPermissions = map[string]struct{}{
-	"nodes.read":      {},
-	"nodes.exec":      {},
-	"nodes.update":    {},
-	"nodes.delete":    {},
-	"jobs.read":       {},
-	"jobs.run":        {},
-	"actions.create":  {},
-	"actions.update":  {},
-	"actions.delete":  {},
-	"users.manage":    {},
-	"secrets.manage":  {},
-	"roles.manage":    {},
-	"logs.read":       {},
+	"nodes.read":       {},
+	"nodes.exec":       {},
+	"nodes.update":     {},
+	"nodes.delete":     {},
+	"jobs.read":        {},
+	"jobs.run":         {},
+	"actions.create":   {},
+	"actions.update":   {},
+	"actions.delete":   {},
+	"actions.execute":  {},
+	"users.manage":     {},
+	"secrets.manage":   {},
+	"roles.manage":     {},
+	"logs.read":        {},
 }
 
 func groupsGetHandler(configDir string) http.HandlerFunc {