Fix MoA single-round and writable read-only panel members

Two bugs surfaced when driving the composite toggle (off→plan→fusion→moa)
in an all-CLI setup (no API keys):

1. MoA ran only 1 round instead of the configured 2. cycleCompositeMode
   fired the multiModelMode PATCH un-serialized and sendMessage did not
   await it, so a message sent right after toggling loaded the session
   before 'moa' was committed → the backend read the prior 'fusion' value
   → 1 round. Persisted totalLayers in the DB confirmed fusion (1) for all
   post-toggle chains. Serialize mode PATCHes into a promise chain (last
   click wins, in order) and await it in sendMessage/sendMessageDirect.

2. A read-only panel member could still write files. ClaudeCliService
   hard-coded --permission-mode acceptEdits, which auto-accepts Write/Edit
   regardless of --allowed-tools, so a member running with planMode=true
   (tools limited to Read/Glob/Grep) could still call write_file. Use
   'plan' when planMode is set; this also closes the same latent hole for
   regular plan-mode users on the shared CLI path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Services/ClaudeCliService.cs

@@ -159,6 +159,12 @@ public class ClaudeCliService
         if (!_isAvailable)
             return new CliChatResult { Success = false, Error = "Claude CLI nicht verfügbar" };
 
+        // Permission-Mode: Im Plan-Modus (auch Panel-Member laufen read-only via planMode=true)
+        // MUSS die Schreib-Sperre über die Permission-Ebene erzwungen werden. 'acceptEdits' würde
+        // Write/Edit AUTOMATISCH akzeptieren – UNABHÄNGIG von --allowed-tools – sodass ein als
+        // read-only gedachter Member (oder ein regulärer Plan-Modus-User) trotzdem Dateien schreiben
+        // könnte. 'plan' blockiert alle Schreib-/Edit-/Bash-Operationen auf Permission-Ebene.
+        var permissionMode = planMode ? "plan" : "acceptEdits";
         var args = new List<string>
         {
             "-p",
@@ -166,7 +172,7 @@ public class ClaudeCliService
             "--output-format", "stream-json",
             "--include-partial-messages",
             "--no-session-persistence",
-            "--permission-mode", "acceptEdits",
+            "--permission-mode", permissionMode,
             "--disallowed-tools", "AskUserQuestion"
         };