How does the power button shut the computer down without root permission?

The hardware power button triggers an ACPI event that acpid (the ACPI daemon) notices and reacts to; in this case by shutting down the system, although you could have it do whatever you want. The ACPI daemon runs as root, so it has permission to shutdown the system. Desktop environments (e.g. gdm for Gnome) typically run as root as well, so I suspect they work the same way -- you don't have permission to shutdown the system, but you can tell gdm you want it shut down and it can do it on your behalf

Michael's answer correctly discusses system function when using the hardware power switch, but most desktop environments actually use dbus for this purpose rather than doing it themselves. For example, GNOME uses dbus's org.freedesktop.Hal.Device.SystemPowerManagement.Shutdown when the shutdown button is clicked. When this is sent, dbus does some checks to determine whether the user sending the message is authorised to perform a shutdown, and if they are, it shuts down the system.

You can emulate this by using dbus-send. For example, to shut down your system using dbus, use something like this:

dbus-send --system --dest=org.freedesktop.Hal /org/freedesktop/Hal/devices/computer org.freedesktop.Hal.Device.SystemPowerManagement.Shutdown