feat: role-based UI access control

- Hide Admin sidebar section for non-ADMIN users
- Add RequireAdmin route guard — /admin/* redirects to / for non-admin
- Move App Config from admin section to main Config tab (per-app,
  visible when app selected). VIEWER sees read-only, OPERATOR+ can edit
- Hide diagram node toolbar for VIEWER (onNodeAction conditional)
- Add useIsAdmin/useCanControl helpers to centralize role checks
- Remove App Config from admin sidebar tree

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/components/sidebar-utils.ts

@@ -101,7 +101,6 @@ export function buildAdminTreeNodes(): SidebarTreeNode[] {
     { id: 'admin:rbac', label: 'Users & Roles', path: '/admin/rbac' },
     { id: 'admin:audit', label: 'Audit Log', path: '/admin/audit' },
     { id: 'admin:oidc', label: 'OIDC', path: '/admin/oidc' },
-    { id: 'admin:appconfig', label: 'App Config', path: '/admin/appconfig' },
     { id: 'admin:database', label: 'Database', path: '/admin/database' },
     { id: 'admin:clickhouse', label: 'ClickHouse', path: '/admin/clickhouse' },
   ];