feat(web): show observers no control that changes shared work - #2552

🟢 Confidence 10/10 · safe to merge. Every write control is gated view-side on the same grant the update re-reads, and 10 new scene tests cover both roles per page; no state, API or schema changes.
_{no findings · tests covered · risk medium}

Adds member-only permissions (dashboards:edit, error_issues:triage, incidents:respond, investigations:run, status_page_incidents:post) and makes dashboards, errors, incidents and status pages read the viewer's grants, so an observer sees readouts instead of controls that would 403. Safe to merge.

• permissions.ts names the seven changes an observer cannot make
• Each page fetches CompletedFetchSession and gates controls on Policy.has
• isEditing now requires dashboards:edit, so ?mode=edit opens read-only
• Labs take ?role= and feed CompletedFetchSession so observer pages render

Fixed since the last review

• ✅ F1 · Dashboard labs never feed grants, so they render read-only in Clerk builds

Production impact

_{8888c59 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}