feat: role-based UI access control

- Hide Admin sidebar section for non-ADMIN users
- Add RequireAdmin route guard — /admin/* redirects to / for non-admin
- Move App Config from admin section to main Config tab (per-app,
  visible when app selected). VIEWER sees read-only, OPERATOR+ can edit
- Hide diagram node toolbar for VIEWER (onNodeAction conditional)
- Add useIsAdmin/useCanControl helpers to centralize role checks
- Remove App Config from admin sidebar tree

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/hooks/useScope.ts

@@ -2,9 +2,9 @@
 import { useParams, useNavigate, useLocation } from 'react-router';
 import { useCallback } from 'react';
 
-export type TabKey = 'exchanges' | 'dashboard' | 'runtime' | 'logs';
+export type TabKey = 'exchanges' | 'dashboard' | 'runtime' | 'logs' | 'config';
 
-const VALID_TABS = new Set<TabKey>(['exchanges', 'dashboard', 'runtime', 'logs']);
+const VALID_TABS = new Set<TabKey>(['exchanges', 'dashboard', 'runtime', 'logs', 'config']);
 
 export interface Scope {
   tab: TabKey;