Add miniapp policy permissions

[Gaubee]

• Add permissions-policy directives + allowlist helpers
• Inject allow into iframe/wujie + runtime sync on source refresh
• Add dev Permissions-Policy header + manifest docs
• Update chain-services miniapp manifests + x-build-project config