Summary

Adds an All Categories entry at the bottom of the category selector on the admin privileges page (/admin/manage/privileges). When selected it shows an aggregated view of category-scoped privileges across every category, with a third "mixed" state for privileges granted in some categories but not others. Toggling a checkbox in this view applies the change to every category at once.

Motivation

Administering privileges across many categories today means either picking categories one by one or using the per-row Copy to all categories action — which silently overwrites every existing per-category difference. There is no way to see, at a glance, which privileges are uniformly granted/denied and which are inconsistent, and no way to make a coarse change ("give group X this privilege everywhere") without losing per-category nuance elsewhere.

Behavior

For each privilege × member (group or user), the aggregated state is one of:

Clicking a mixed checkbox once turns it on for every category (or off, depending on the resulting state) — it is always a real change, never a no-op. Rows that inherit from a parent group in the mixed state are themselves marked indeterminate, so the effective inheritance is visible rather than rendering as plain false.

Implementation notes

• privileges.categories.listAll() (new) aggregates membership across all cids. Two new helpers in src/privileges/helpers.js (getGroupPrivilegesAll / getUserPrivilegesAll) batch the underlying getMembersOfGroups reads — one call per privilege × cid, then in-memory aggregation — instead of N round-trips per category.
• API getPrivileges / setPrivilege handle the cid === 'all' sentinel; the latter fans give / rescind out over every cid via the existing array-cid path of helpers.giveOrRescind.
• spawnPrivilegeStates marks a checkbox checked only when the state is literally true, so mixed renders unchecked and is then promoted to indeterminate client-side by a new Privileges.exposeMixedPrivileges(). The mixed pass runs before exposeAssumedPrivileges() so inheritance can see indeterminate parents as granted; getPrivilegesFromRow now also picks up indeterminate checkboxes for this reason.
• categorySearch gains an appendCategories option (mirroring localCategories) that places entries after the API search results, so the All Categories pseudo-entry sits at the bottom of the dropdown rather than at the top.

Safety

• categories.copyPrivilegesFrom now rejects a non-numeric fromCid / toCid. With the previous code, copying from an invalid source produced fromChecks = [false, false, …], which made copyPrivilegesByGroup interpret every privilege the target currently held as "in target but not in source" — i.e. every such privilege would be rescinded. The guard turns that into [[error:invalid-data]]. (This also closes the same hazard against a direct socket call, not just the UI button.)
• The per-row Copy dropdown and the three footer copy buttons (Copy from category, Copy to children, Copy to all categories) are hidden in the All Categories view, since "copy from the aggregate" has no well-defined source; the client also guards the three copy functions defensively.

Files changed

Out of scope / non-goals

• Global (cid 0) and Admin privileges are unchanged — All Categories aggregates only category-scoped (cid > 0) privileges, mirroring the scope of the existing per-category view.
• No new privilege types are introduced; this is a pure presentation/edit-surface change.

Manual verification

• Backend listAll() returns groups with state ∈ {true, false, 'mixed'} once at least one category has a differing privilege.
• Toggling a checkbox in the All Categories view issues a single PUT/DELETE /api/v3/categories/all/privileges/:privilege call which fans out across cids.
• Attempting the legacy copy paths with cid === 'all' is blocked by both the UI (buttons hidden) and the server-side guard in copyPrivilegesFrom.