V13-FE-006: consolidate approved UI and contract hardening

frontend/src/shared/auth/routeAccess.ts

@@ -0,0 +1,9 @@
+export type RouteAccessMeta = {
+  readonly permissions?: readonly string[]
+}
+
+/** UI visibility hint only; the API remains the authorization authority. */
+export function canAccessRoute(meta: RouteAccessMeta, grantedPermissions: ReadonlySet<string>): boolean {
+  const required = meta.permissions ?? []
+  return required.every(permission => grantedPermissions.has(permission))
+}