Add watch button to instance overview (fixes #655)

As watching an instance results in quite a few notifications being generated, a new permission `watch.instance` is created, which is only assigned to moderators and higher by default.