Expose SUBMIT_INCOME in permission management UI

Adds the new permission type to the grant/bulk-grant dialog dropdown
(static/js/permissions.js) so admins can grant 'Submit Income' on
revenue accounts the same way they grant 'Submit Expense' on expense
accounts. Without this, the backend's SUBMIT_INCOME check on the new
income endpoint is ungranted-able from the UI and users see a 403.

Uses 'teal' + the 'payments' icon to distinguish income-grant badges
from green-and-add_circle expense-grant badges in the role/account
permission lists. Also updates a stale comment in migrations.py
listing the valid permission_type values.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

migrations.py

@@ -240,7 +240,7 @@ async def m001_initial(db):
     # ACCOUNT PERMISSIONS TABLE
     # =========================================================================
     # Granular access control for accounts
-    # Permission types: read, submit_expense, manage
+    # Permission types: read, submit_expense, submit_income, manage
     # Supports hierarchical inheritance (parent account permissions cascade)
 
     await db.execute(

static/js/permissions.js

@@ -53,6 +53,11 @@ window.app = Vue.createApp({
           label: 'Submit Expense',
           description: 'Submit expenses to this account'
         },
+        {
+          value: 'submit_income',
+          label: 'Submit Income',
+          description: 'Submit income/revenue entries to this account'
+        },
         {
           value: 'manage',
           label: 'Manage',
@@ -501,6 +506,8 @@ window.app = Vue.createApp({
           return 'blue'
         case 'submit_expense':
           return 'green'
+        case 'submit_income':
+          return 'teal'
         case 'manage':
           return 'red'
         default:
@@ -514,6 +521,8 @@ window.app = Vue.createApp({
           return 'visibility'
         case 'submit_expense':
           return 'add_circle'
+        case 'submit_income':
+          return 'payments'
         case 'manage':
           return 'admin_panel_settings'
         default: