Moves the generate_handler! parser out of the lib.rs test into src/command_census.rs and adds the capability rules (one allow-* grant per command, in the file its name says, no deny-*) with unit tests. No behaviour change yet: build.rs does not use it until the next commit. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>