feat(web): show analysts no control the API refuses them - #2552

🟢 Confidence 10/10 · safe to merge. All 59 files read; gates match the domain permission table and every page that reads grants fetches them, only the brief pre-session window differs from before.
_{no findings · tests covered · risk medium}

Hides the dashboard's write controls wherever the viewer's grants lack the matching permission: errors list and issue, incident and anomaly pages, status page editor, investigations list. The gates read the same domain permission table the API enforces, and the new scene tests pin both the analyst and member views.

• Errors list and issue drop every error_issues:triage control, with x/s/p inert.
• Incident and anomaly pages gate acknowledge, resolve, link and investigate on incidents:respond and investigations:run.
• Status page editor hides post, update, resolve and delete behind status_page_incidents:post.
• The policy table gains five member-level permissions the pages now read.

Production impact

_{ebf5352 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}