fix(studio): preflight IAM permissions before OTA updates

[evanlowe]

Summary

• add an OTA IAM permission preflight before any Studio update changes cloud resources
• show the active Function role, attached policy, missing actions, and a provider-specific prefilled UpdatePolicy API Explorer link
• support retrying the preflight after the user confirms authorization
• include Scheduler, Worker, Timer, dependency-install, and TOS permissions for both Volcengine and BytePlus
• make Scheduler/Worker/Timer deployment idempotent and extend long-running update request timeouts
• accept BytePlus Timer JSON-string payloads in the Scheduler HTTP entrypoint

Validation

• pre-commit run --all-files
• uv run pytest -q tests/cli/test_studio_release.py tests/cli/test_studio_self_update.py tests/cli/test_studio_update_permissions.py tests/frontend/service/studio_scheduler/test_scheduler_deploy.py tests/frontend/service/studio_scheduler/test_http_app.py — 69 passed
• npm test — 761 passed
• npx tsc --noEmit
• npm run test:webui-assets
• desktop and 390x844 mobile visual checks for permission and update states
• Volcengine cloud OTA: Studio, Scheduler, Worker, and both Timer triggers verified
• BytePlus cloud OTA: permission flow, Studio, Scheduler, Worker, both Timer triggers, and a real scheduled Runtime execution verified

Cloud verification

• final tested OTA release: 20260824161038
• BytePlus Scheduler and Worker Timer requests return HTTP 200
• Volcengine Scheduler and Worker Timer requests return HTTP 200