feat: role-based UI access control

- Hide Admin sidebar section for non-ADMIN users
- Add RequireAdmin route guard — /admin/* redirects to / for non-admin
- Move App Config from admin section to main Config tab (per-app,
  visible when app selected). VIEWER sees read-only, OPERATOR+ can edit
- Hide diagram node toolbar for VIEWER (onNodeAction conditional)
- Add useIsAdmin/useCanControl helpers to centralize role checks
- Remove App Config from admin sidebar tree

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/components/ContentTabs.tsx

@@ -3,13 +3,18 @@ import type { TabKey, Scope } from '../hooks/useScope';
 import { TabKpis } from './TabKpis';
 import styles from './ContentTabs.module.css';
 
-const TABS = [
+const BASE_TABS = [
   { label: 'Exchanges', value: 'exchanges' },
   { label: 'Dashboard', value: 'dashboard' },
   { label: 'Runtime', value: 'runtime' },
   { label: 'Logs', value: 'logs' },
 ];
 
+const TABS_WITH_CONFIG = [
+  ...BASE_TABS,
+  { label: 'Config', value: 'config' },
+];
+
 interface ContentTabsProps {
   active: TabKey;
   onChange: (tab: TabKey) => void;
@@ -17,10 +22,12 @@ interface ContentTabsProps {
 }
 
 export function ContentTabs({ active, onChange, scope }: ContentTabsProps) {
+  // Config tab only shown when an app is selected
+  const tabs = scope.appId ? TABS_WITH_CONFIG : BASE_TABS;
   return (
     <div className={styles.wrapper}>
       <Tabs
-        tabs={TABS}
+        tabs={tabs}
         active={active}
         onChange={(v) => onChange(v as TabKey)}
       />