Default new sub-accounts to store:create+store:manage, backfill empty permissions on /partner/me, and treat legacy store staff as allowed to mutate. Co-authored-by: Cursor <cursoragent@cursor.com>