fix(frontend): hide admin-only node and system controls from non-admins (#222, #283)

UI gate only — no route auth changes. Node page: override Ack/Force
Revert, Configure/Reassign and Restart OP25 are admin-only; non-admins on
an unconfigured node get a "an admin needs to assign it" note. /nodes
"Needs Configuration" cards open the config modal only for admins, and
link to the node page otherwise. /systems: New/Edit/Duplicate/Delete and
the AI-flags, area-context, talkgroup-pending and vocabulary panels are
admin-only; operators get a read-only list. (Delete's missing catch was
fixed in #290.)

Widening any of these routes to org owners/operators is a separate,
security-reviewed backend change.

Frontend unverified: no Node on the authoring box (#207).

Closes #222
Closes #283

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-frontend/app/nodes/page.tsx

@@ -79,9 +79,15 @@ export default function NodesPage() {
           </h2>
           <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
             {pending.map((n) => (
-              <div key={n.node_id} onClick={() => setConfigNode(n)} className="cursor-pointer">
-                <NodeCard node={n} system={systemMap[n.assigned_system_id ?? ""]} linkToDetail={false} />
-              </div>
+              // Configuring is admin-only on the server (server-26#222); for
+              // everyone else the card links to the node page instead.
+              isAdmin ? (
+                <div key={n.node_id} onClick={() => setConfigNode(n)} className="cursor-pointer">
+                  <NodeCard node={n} system={systemMap[n.assigned_system_id ?? ""]} linkToDetail={false} />
+                </div>
+              ) : (
+                <NodeCard key={n.node_id} node={n} system={systemMap[n.assigned_system_id ?? ""]} />
+              )
             ))}
           </div>
         </div>