Add a read-only role per app for calendar, feedback and tickets

A grant can now be `read` instead of `access`: requireAppAccess lets it
through for GET/HEAD/OPTIONS and answers 403 to every other method, so
new write routes are covered without being marked. `read` and `access`
on the same app are rejected together; user management has no read role.
/tickets/admin/me and /feedback/admin/me report `readOnly`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/models/tickets/admin/admin.router.ts

@@ -1,5 +1,6 @@
 import express, {Request, Response} from 'express';
 import {requireAdminAuth} from '../tickets.auth.js';
+import {isReadOnly} from '../../admin/admin.schema.js';
 import {vouchersAdminRouter} from './vouchers.admin.router.js';
 import {redemptionsAdminRouter, voucherHistoryRouter} from './redemptions.admin.router.js';
 import {eventsAdminRouter} from './events.admin.router.js';
@@ -21,13 +22,30 @@ adminRouter.use(requireAdminAuth);
  *          responses:
  *              200:
  *                  description: Success
+ *                  content:
+ *                      application/json:
+ *                          schema:
+ *                              type: object
+ *                              properties:
+ *                                  email:
+ *                                      type: string
+ *                                  fullName:
+ *                                      type: string
+ *                                  readOnly:
+ *                                      type: boolean
+ *                                      description: Holds only the read role for tickets - every write answers 403.
  *              401:
  *                  description: Unauthorized
  *              403:
  *                  description: Signed in without the permission for this app, or account disabled
  */
 adminRouter.get('/me', (req: Request, res: Response) => {
-	res.status(200).send({email: res.locals.admin.email, fullName: res.locals.admin.displayName});
+	res.status(200).send({
+		email: res.locals.admin.email,
+		fullName: res.locals.admin.displayName,
+		// Lets the frontend hide what the API would refuse anyway.
+		readOnly: isReadOnly(res.locals.admin.permissions, 'tickets')
+	});
 });
 
 adminRouter.use('/vouchers', vouchersAdminRouter);