fix(approval): email-link approvers without view:purchases cannot approve, and the retry toast is wrong for permanent errors #529

Summary

Since #497 the approval modal rejects when the purchase-details fetch fails. A user whose account lacks view:purchases, or whose scope excludes the purchase, gets 403/404 from the details call and cannot approve from the email link at all. The retry toast is also wrong for permanent errors.

Location (origin/main 496d9d7)

• frontend/src/purchases-deeplink.ts:86-97: on a details failure the code toasts ... Open the approval link again to retry. (:92) and returns, whatever the status.
• The email-token approval path authorizes through contact_email without RBAC, so the user is entitled to approve but cannot read the details the modal now requires.

Failure scenario

A read-only approver (no view:purchases) opens the approval email link. The details request returns 403, the modal never opens, and the toast tells them to retry, which can never succeed.

Suggested fix

• Add a token-authorized details read, for example GET /api/purchases/approve/{id} after the contact_email check.
• In the toast, say the user needs view:purchases and account access for 403/404; keep "retry" for network and 5xx errors.

Context

Related: #432, #434.

Acceptance

An email-link approver without view:purchases can see the details and approve, and a permanent 403/404 no longer tells the user to retry.