feat(rbac): Viewer-Rolle durchsetzen — alle Mutations nur für Admins

- middleware.go: RequireAdminForMutations() blockiert POST/PUT/DELETE
  für Nicht-Admins (GET/HEAD passieren immer durch)
- main.go: Middleware in den authed-Gruppe eingehängt — wirkt für
  alle ~30 Resource-Handler gleichzeitig
- api/client.ts: 403 → AntD-Notification "Nur Lesezugriff" statt
  stiller Fehler
- Header: "Nur lesen"-Badge + Tooltip wenn role=viewer
- i18n de+en: viewerBadge + viewerHint

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/middleware.go

@@ -117,4 +117,27 @@ func tokenFromRequest(c *gin.Context) string {
 	return ""
 }
 
+// RequireAdminForMutations blocks non-GET/HEAD requests from non-admin
+// users. GET and HEAD are always allowed for authenticated users so
+// read-only ("viewer") accounts can browse all data. Every state-
+// changing request (POST, PUT, PATCH, DELETE) requires role="admin".
+//
+// Must be mounted AFTER RequireAuth so the token is already in context.
+func RequireAdminForMutations() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		m := c.Request.Method
+		if m == http.MethodGet || m == http.MethodHead || m == http.MethodOptions {
+			c.Next()
+			return
+		}
+		tok := CurrentToken(c)
+		if tok == nil || tok.Role != "admin" {
+			response.Err(c, http.StatusForbidden, errors.New("admin_required"))
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
 func ptr[T any](v T) *T { return &v }