feat(auth): let analysts read and build dashboards, and refuse every other change - #2546

🟢 Confidence 10/10 · safe to merge. The gate is one four-line pure function wired into every auth path, and real middleware tests pin both the refusal and the allowed reads.
_{no findings · tests covered · risk high · 1/1 new units observable}

Refuses an analyst-role session or credential every non-GET endpoint on the internal and /v2 APIs unless the endpoint is annotated AnalystAccess or the /v2 scope registry already calls it a read. The check lives in the auth layers, so an unmarked endpoint fails closed, and it is covered by middleware-level tests.

• checkAnalystAccess refuses analysts by default in all three auth middlewares
• AnalystAccess annotation opens reads, own-state writes and dashboard authoring
• /v2 dashboard writes are marked author: analysts may create, share and delete
• LimitedRoleError (403 limited_role) added to the middleware error unions

Before merge

• Manual · Check the Clerk role keys on dev and prd map to a known clerkKey: roleOf falls back to analyst, which now refuses every write

Production impact

_{f72b00b · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}