Execute a capability on the user's live frontend (surface render/clear, control get/set). Used by the tfa-surface CLI.
Successful response
The frontend host's capability catalog (surfaces + controls with effect/permission metadata).
