feat(settings): complete #802 settings API integration gaps

[vbeni30]

Summary

• Gate settings navigation tabs by backend permissions
• Surface tag load failures instead of showing silent empty lists
• Remove the /settings legacy rewrite so the Next.js page is canonical
• Add frontend tests for the API client, server actions, and settings panels (reads, writes, validation, forbidden)

Test Plan

• pnpm run frontend:typecheck
• Vitest settings suite (45 tests)
• dotnet test SettingsApiController (4 tests)