frontend: hide radio-bot pool controls from non-admins (server-26#213 item 4)

GET /tokens and PUT /tokens/{id}/prefer became platform-admin only in #216
(server-26#204 item 6). Three frontend surfaces still offered them to
operators:

- systems page "Preferred Bot Token" panel: now rendered for admins only.
  No non-admin listing endpoint was added: the write behind the picker is
  admin-only too, so a list would only feed a control that 403s on save.
  The panel also no longer turns a fetch error into "No tokens in pool."
- /tokens page: admin-only (operators are sent to /network).
- /network hub: the Bot Tokens card is shown to admins only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-frontend/app/network/page.tsx

@@ -91,13 +91,17 @@ export default function NetworkPage() {
           count={systemsLoading ? null : systems.length}
           countLabel={systemsLoading ? "" : "configured"}
         />
-        <HubCard
-          href="/tokens"
-          title="Bot Tokens"
-          description="Discord bot tokens available for nodes to claim when relaying live audio."
-          count={null}
-          countLabel="manage"
-        />
+        {/* The radio-bot pool is platform-admin only (server-26#204 item 6);
+            an operator following this card only hit a 403 (server-26#213). */}
+        {isAdmin && (
+          <HubCard
+            href="/tokens"
+            title="Bot Tokens"
+            description="Discord bot tokens available for nodes to claim when relaying live audio."
+            count={null}
+            countLabel="manage"
+          />
+        )}
       </div>
     </div>
   );