Add a read-only role per app for calendar, feedback and tickets

A grant can now be `read` instead of `access`: requireAppAccess lets it
through for GET/HEAD/OPTIONS and answers 403 to every other method, so
new write routes are covered without being marked. `read` and `access`
on the same app are rejected together; user management has no read role.
/tickets/admin/me and /feedback/admin/me report `readOnly`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -47,8 +47,9 @@ and `/admin` for the JSON routes. Sessions are httpOnly cookies scoped to
 `.nachklang.art`, so one sign-in covers every app. Accounts are **invite-only** — public
 sign-up is disabled, and `invitations.plugin.ts` is the only code that creates users.
 A permission is **(app, role)** in `user_app_permissions`, keyed on
-`(user_id, app, role)` so one user can hold several roles per app. `access` is the only role
-today and means "may use this app at all"; `APP_ROLES` in `admin.schema.ts` is the contract,
+`(user_id, app, role)` so one user can hold several roles per app. Two roles exist: `access`
+(full access) and `read` (read-only, not for `admin`) - see `docs/admin-roles.md`, including
+how `requireAppAccess` enforces `read` by HTTP method; `APP_ROLES` in `admin.schema.ts` is the contract,
 and a role not listed there is rejected rather than written. `requireAppAccess(app)` in
 `admin.middleware.ts` is the single authenticator - it takes an optional second argument to
 narrow to one role, and queries the database on every request (no cookie cache) so disabling