feat(labels): harden Stack Labels (gate parity, abort, dry-run, cap) (#1232)

* feat(labels): harden stack-labels surface (gate parity, abort, dry-run policy, cap)

- Cap labelIds array at MAX_LABELS_PER_NODE on PUT /api/stacks/:name/labels.
- Hide sidebar Labels submenu and Settings mutation buttons for roles
  without stack:edit, matching the backend requirePermission gate.
- Break the per-label bulk-action loop on req.aborted so cancelled requests
  release the per-node lock once the in-flight op completes.
- Reset saving state on success in LabelInlineCreateForm so the form stays
  interactive when reused outside the kebab/context menus.
- Invoke enforcePolicyPreDeploy inside the dry-run deploy branch and report
  blocked stacks honestly; previously dry-run skipped the gate and would
  predict success for stacks the real deploy would block.

* fix(labels): split sidebar gate so inline create matches unscoped backend guard

Codex review of #1232 surfaced a parity miss: POST /api/labels is guarded
by unscoped requirePermission('stack:edit'), but the sidebar inline "New
label" entry was gated by canEditLabels (per-stack scoped). An Admiral
user with only scoped grants on a stack could toggle existing labels but
the inline create request would 403.

Splits the sidebar gate:
- canEditLabels (scoped) keeps gating the Labels submenu trigger and toggle
  items, matching PUT /api/stacks/:name/labels.
- canCreateLabels (unscoped) now gates the inline "New label" entry,
  matching POST /api/labels.

Also restores the swallow-catch in LabelInlineCreateForm. The earlier
catch-to-finally change in #1232 let the rethrow from createAndAssignLabel
surface as an unhandled event-handler rejection in the browser console.
Parents already toast on failure; swallowing in the form is the intended
behavior with the finally reset still in place.

frontend/src/hooks/__tests__/useStackMenuItems.test.tsx

@@ -12,6 +12,8 @@ function makeCtx(overrides: Partial<StackMenuCtx> = {}): StackMenuCtx {
     isPaid: true,
     isAdmiral: false,
     canDelete: true,
+    canEditLabels: true,
+    canCreateLabels: true,
     isPinned: false,
     labels: [],
     assignedLabelIds: [],
@@ -106,6 +108,16 @@ describe('useStackMenuItems', () => {
     expect(labelsItem?.subItems?.[0]).toMatchObject({ id: 'label:1', label: 'prod' });
   });
 
+  it('hides the Labels submenu when !canEditLabels (viewer role)', () => {
+    const { result } = renderHook(() => useStackMenuItems('web.yml', makeCtx({
+      canEditLabels: false,
+      labels: [{ id: 1, node_id: 0, name: 'prod', color: 'teal' }],
+    })));
+    const organize = result.current.find(g => g.id === 'organize')!;
+    expect(organize.items.find(i => i.id === 'labels')).toBeUndefined();
+    expect(organize.items.find(i => i.id === 'pin')).toBeDefined();
+  });
+
   it('auto-update toggle calls setAutoUpdateEnabled with toggled value', () => {
     const setAutoUpdateEnabled = vi.fn();
     const { result } = renderHook(() =>