docs: rewrite the custom resources guide for the reconcile flow

[rohilsurana]

What

Rewrites the "Custom Resources and Permissions" guide to match the new model. The boot-time resources_config_path loader is gone (removed in #1767), so custom permissions and roles are registered through the frontier reconcile flow or the admin API now, not a config file read at startup.

Changes:

• Rewrites "How custom resources are registered": the reconcile Permission / Role document format, the frontier reconcile and frontier export commands, and the reconcile rules (identity-only permissions, delete needs delete: true, app/... namespaces rejected).
• Explains what happens when a permission is registered: AppendSchema regenerates the schema (base schema plus every permission in the database) and writes to Postgres and SpiceDB, and the same step runs at boot.
• Keeps the accurate schema-generation and role-mapping sections, updated for the new flow.
• Updates the user/project proxy section: app/... namespaces are now rejected with an error by both reconcile and the admin API, instead of being silently ignored from a config file.
• Updates the role examples to kind: Role documents and the reconcile role semantics: a listed field is the whole desired value (so listing permissions replaces the set), while an omitted field keeps the role's default.
• Removes emdashes to match our writing style.

Why

The old guide described the removed boot-time config-file loader end to end. #1767 added a short banner as a stopgap; this replaces the banner with a full rewrite.

Stacked on #1767

This is stacked on chore/remove-resources-config-path-flow (#1767), because the guide describes the world after that PR removes the loader. Retarget to main once #1767 merges.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview	Aug 11, 2026 10:26am

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b35314ce-933b-4735-81d6-b2be232b6d4a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coveralls]

Coverage Report for CI Build 31482211217

Coverage remained the same at 48.082%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	39861
Covered Lines:	19166
Line Coverage:	48.08%
Coverage Strength:	15.39 hits per line

---

💛 - Coveralls