Connection permissions now session-scoped

Before this change, setting up Computer Use meant a multi-step configuration wizard before every connection — users picked a template, edited permission modes per tool group, and set a filesystem root directory. Those settings were written to disk and applied globally.

Now permissions are session-scoped. A new GatewaySession class holds the effective permissions and working directory for each connection. On first run, the settings file is created automatically with the Recommended template — no prompts. Stored permissions become defaults for future connect prompts, not permanent locks.

When connecting, users see a single confirmation showing the URL, current permission table, and working directory. They can choose Yes, Edit, or No. Edits are applied to the session object and used for that connection only — never written back to the settings file. Only resource-level rules like "Always allow /path/to/file" still persist across sessions.

The change simplifies the startup experience while preserving flexibility. Developers testing different permission modes no longer need to edit config files or remember to reset settings afterward.