Brief description of the intended change

Custom panel modules (manifest.json nav / cards) now respect Settings → Panel Users section permissions the same way stock panel pages do. Panel Users only receive manifest entries for sections they can read; websocket section, INIDB table, and Rhino scriptPath checks resolve through manifest metadata. Read-only users still see custom UI where allowed, but writes are blocked server-side and in the panel with the standard permission toast.

PhantomBot/source/com/mcawful/CustomPanelManifestRegistry.java

• New runtime index built when manifests are merged.
• Maps settingsModal field table names and card scriptPath values to manifest section (games, extra, etc.) for PanelUserHandler.

PhantomBot/source/com/mcawful/CustomPanelManifestCollector.java

• Rebuilds CustomPanelManifestRegistry after each manifest merge.
• Adds filterManifestBytesForPanelUser() to drop nav / cards entries the logged-in Panel User cannot read.
• Fail-closed: on filter failure or empty cache for a Panel User, returns {"nav":[],"cards":[]} instead of the unfiltered merge.
• Config users and unauthenticated manifest requests still receive the full merged JSON.

PhantomBot/source/com/mcawful/CustomPanelManifestCache.java

• Exposes computeStrongEtag() so filtered per-user manifest bodies get correct ETag / 304 behavior.

PhantomBot/source/tv/phantombot/httpserver/HTTPPanelAndYTHandler.java

• Resolves the logged-in Panel User for GET /panel/custom-manifests.json.
• Serves filtered manifest bytes and a per-user strong ETag via sendCachedBytes.

PhantomBot/source/tv/phantombot/panel/PanelUser/PanelUserHandler.java

• Resolves INIDB table access via CustomPanelManifestRegistry.panelSectionForTable() before stock section table lists.
• Resolves script access via panelSectionForScript() when the script is declared on a manifest card.

PhantomBot/resources/web/panel/js/utils/customPanelManifestLoader.js

• Adds panelSectionAccess, panelSectionCanWrite, requirePanelSectionWrite, and notifyPanelWriteDenied on window.__pbCustomPanel__.
• Normalizes manifest section keys to Panel Users section names (e.g. keywords → keywords & emotes).

PhantomBot/resources/web/panel/js/utils/customPanelNav.js

• Sets data-panel-section on manifest-injected sidebar links from nav.section.

PhantomBot/resources/web/panel/js/utils/ajaxLoader.js

• Stores panelSection on $.currentPage() when loading a page from a nav link.

PhantomBot/resources/web/panel/js/index.js

• Sends websocket message.section from panelSection (manifest section) instead of the custom/... folder path.

PhantomBot/resources/web/panel/js/utils/customPanelCards.js

• Disables module toggle and settings cog for read-only users; blocked clicks show the stock permission toast.
• Uses aria-disabled and read-only CSS on the settings cog (not Bootstrap disabled, so clicks still reach the toast handler).
• Skips initial modules DB load when the user cannot write.

PhantomBot/resources/web/panel/js/utils/customPanelSettingsModal.js

• Guards openSettingsModal and save with requirePanelSectionWrite for the card’s manifest section.

PhantomBot/docs/guides/content/developerdocs/custommodules.md

• Documents section-based Panel User permissions for declarative cards and nav-only custom pages.
• Describes __pbCustomPanel__ helpers, read-only UI patterns, and troubleshooting (wrong section, async delete success).