Promotes PermissionResolverParams from a non-exported type alias to an exported interface so consumers can import the resolver-callback contract by name. Today, resolver authors have to either rely on Config.permissionResolver inference or write Parameters<NonNullable<Config['permissionResolver']>>[0] — neither is discoverable.

One real omission landed alongside the export. The runtime always forwards defaultDecision: boolean to the resolver (computed locally in permissions.js:isAllowed), but the non-exported helper omitted it. Resolver authors who wanted to defer to (or branch off) the built-in policy had to re-derive it. Adding it surfaces the value at the type level.

Field-presence tightened to match runtime exactly. The runtime spreads every field into the object literal it passes to the resolver, so every key is always present. role and isInternal can hold undefined values; comment, trackedChange, currentUser, and superdoc are coalesced to null and never undefined. Switched from optional (?:) properties to non-optional with explicit | undefined / | null types so the type reflects what the resolver actually receives, not what the consumer might construct. This is a tighter contract — existing resolvers reading these fields with params.role continue to work because string | undefined is structurally the same for reads.

Distinct from CanPerformPermissionParams (consumer input shape):

• CanPerformPermissionParams is what consumers pass into SuperDoc#canPerformPermission.
• PermissionResolverParams is what consumer resolvers receive, enriched with defaultDecision, currentUser, and superdoc.

Also fixes a stale doc on CanPerformPermissionParams that still referred to PermissionResolverParams as "non-exported" — that became false in this PR.

Consumer fixture (permission-resolver-params-apis.ts) asserts both resolver slots use the named type:

• Config.permissionResolver
• Modules.comments.permissionResolver

Drift between the two slots would slip past the public-method-coverage gate (callbacks aren't gate-tracked) but fails on AssertEqual here.

Stacked on #3503; retarget to main after that PR merges.

Verified: pnpm check:types -> PASS; pnpm check:public:superdoc --skip-build -> PASS (9 ran, 1 skipped, 129.6s); pnpm --filter superdoc test --run -> PASS (1054/1054).