fix: harden blueprint deployment guardrails (#1027)

* fix: harden blueprint deployment guardrails

* fix: update Docker toolchain to Go 1.26.3

* fix: repair Dockerfile tr argument split across lines

* fix: bump protobufjs to clear npm audit high-severity advisories

frontend/src/components/blueprints/BlueprintCatalog.tsx

@@ -11,6 +11,7 @@ interface BlueprintCatalogProps {
     blueprints: BlueprintListItem[];
     onSelect: (id: number) => void;
     onCreate: () => void;
+    canCreate: boolean;
 }
 
 type ModeFilter = 'all' | 'observe' | 'suggest' | 'enforce' | 'drifted';
@@ -41,7 +42,7 @@ function statusDot(status: BlueprintDeploymentStatus | null): string {
     }
 }
 
-export function BlueprintCatalog({ blueprints, onSelect, onCreate }: BlueprintCatalogProps) {
+export function BlueprintCatalog({ blueprints, onSelect, onCreate, canCreate }: BlueprintCatalogProps) {
     const [filter, setFilter] = useState<ModeFilter>('all');
 
     const counts = useMemo(() => {
@@ -69,10 +70,12 @@ export function BlueprintCatalog({ blueprints, onSelect, onCreate }: BlueprintCa
                         Deployments · Blueprints
                     </span>
                 </div>
-                <Button size="sm" onClick={onCreate} className="gap-2">
-                    <Plus className="h-4 w-4" strokeWidth={1.5} />
-                    New Blueprint
-                </Button>
+                {canCreate && (
+                    <Button size="sm" onClick={onCreate} className="gap-2">
+                        <Plus className="h-4 w-4" strokeWidth={1.5} />
+                        New Blueprint
+                    </Button>
+                )}
             </div>
 
             <div className="flex items-center gap-1 flex-wrap">

frontend/src/components/blueprints/BlueprintEmptyState.tsx

@@ -3,9 +3,10 @@ import { Button } from '@/components/ui/button';
 
 interface BlueprintEmptyStateProps {
     onCreate: () => void;
+    canCreate: boolean;
 }
 
-export function BlueprintEmptyState({ onCreate }: BlueprintEmptyStateProps) {
+export function BlueprintEmptyState({ onCreate, canCreate }: BlueprintEmptyStateProps) {
     return (
         <div className="mx-auto max-w-3xl rounded-xl border border-card-border border-t-card-border-top bg-card shadow-card-bevel">
             <div className="flex flex-col gap-5 p-8">
@@ -30,10 +31,12 @@ export function BlueprintEmptyState({ onCreate }: BlueprintEmptyStateProps) {
                     <span className="font-mono text-[10px] uppercase tracking-[0.18em] text-stat-icon">
                         First blueprint, no fleet required
                     </span>
-                    <Button size="sm" onClick={onCreate} className="gap-2">
-                        <Sparkles className="h-4 w-4" strokeWidth={1.5} />
-                        Create your first Blueprint
-                    </Button>
+                    {canCreate && (
+                        <Button size="sm" onClick={onCreate} className="gap-2">
+                            <Sparkles className="h-4 w-4" strokeWidth={1.5} />
+                            Create your first Blueprint
+                        </Button>
+                    )}
                 </div>
             </div>
         </div>

frontend/src/components/blueprints/DeploymentsTab.tsx

@@ -95,12 +95,13 @@ export function DeploymentsTab() {
     return (
         <div className="space-y-5">
             {blueprints.length === 0 ? (
-                <BlueprintEmptyState onCreate={() => setCreateOpen(true)} />
+                <BlueprintEmptyState onCreate={() => setCreateOpen(true)} canCreate={canEdit} />
             ) : (
                 <BlueprintCatalog
                     blueprints={blueprints}
                     onSelect={setSelectedId}
                     onCreate={() => setCreateOpen(true)}
+                    canCreate={canEdit}
                 />
             )}