feat: expose Community audit log via system:audit navigation (#1740)

* feat(rbac): make Settings authorization permission-aware

Align Settings visibility and mutations with the existing permission matrix so Node Admin can edit node-scoped operational settings while system and credential surfaces stay Admin-protected.

* fix(rbac): tighten settings permission buckets and tests

Collapse settings key permission maps into one source of truth, and cover mixed PATCH atomicity plus image-update enabled writes.

* fix(rbac): tighten Settings scoped grants and CI assertions

Empty settings PATCH fails closed, node:manage is scoped to the active
node, system-only Settings stay hidden without system:settings, and
Check updates / webhooks mutate gates follow the permission matrix.

* fix(rbac): defer Settings section fallback until authz is ready

Keep deep links to permission-gated sections (e.g. license) intact while
can() is still fail-closed during permission metadata load.

* feat: expose Community audit log via system:audit navigation

Gate the Audit view on the system:audit permission instead of paid tier,
so Community admins can open the existing 14-day recent-activity window.
Export, anomaly flags, and stats remain Admiral-only.

* test: clarify synthetic Community admin mock lacks system:audit

Document that mockCommunityAdmin is a gate-isolation helper, not the
real Admin permission matrix where system:audit is always present.

frontend/src/lib/routing/reachability.test.ts

@@ -25,13 +25,15 @@ function ctx(over: Partial<ReachabilityContext> = {}): ReachabilityContext {
 }
 
 describe('reachability', () => {
-  it('does not hide views while authz is loading', () => {
-    const loading = ctx({ permissionsStatus: 'loading' });
+  it('does not hide views while authz is loading or failed', () => {
+    const loading = ctx({
+      permissionsStatus: 'loading',
+      can: () => false,
+      isPaid: false,
+    });
     expect(authzReady(loading)).toBe(false);
     expect(isViewHidden('audit-log', loading)).toBe(false);
-  });
 
-  it('keeps deep links stable when permission metadata fails', () => {
     const failed = ctx({ permissionsStatus: 'error', can: () => false, isAdmin: false });
     expect(authzReady(failed)).toBe(false);
     expect(isViewHidden('fleet', failed)).toBe(false);
@@ -51,24 +53,20 @@ describe('reachability', () => {
     expect(isViewHidden('scheduled-ops', viewer)).toBe(true);
   });
 
-  it('hides fleet without node:read when ready', () => {
-    const noFleet = ctx({ can: () => false });
-    expect(isViewHidden('fleet', noFleet)).toBe(true);
-    expect(isViewHidden('networking', noFleet)).toBe(true);
+  it('hides fleet and networking without node:read when ready', () => {
+    const noNodeRead = ctx({ can: () => false });
+    expect(isViewHidden('fleet', noNodeRead)).toBe(true);
+    expect(isViewHidden('networking', noNodeRead)).toBe(true);
   });
 
-  it('preserves host-console when authz is not ready', () => {
+  it('gates host-console on system:console only (any tier, any experimental state)', () => {
     const licenseError = ctx({ licenseStatus: 'error', can: (a) => a === 'system:console' });
     expect(isViewHidden('host-console', licenseError)).toBe(false);
-  });
 
-  it('hides host-console without system:console when ready', () => {
     const noConsole = ctx({ can: () => false, isPaid: false, experimental: false });
     expect(isViewHidden('host-console', noConsole)).toBe(true);
     expect(normalizeHiddenView('host-console', noConsole)).toBe('dashboard');
-  });
 
-  it('keeps host-console for system:console regardless of tier or experimental', () => {
     const community = ctx({
       isPaid: false,
       experimental: false,
@@ -78,6 +76,18 @@ describe('reachability', () => {
     expect(isViewHidden('host-console', community)).toBe(false);
   });
 
+  it('gates audit-log on system:audit only (Community and paid)', () => {
+    expect(
+      isViewHidden('audit-log', ctx({ isPaid: false, can: (a) => a === 'system:audit' })),
+    ).toBe(false);
+
+    const noAuditCommunity = ctx({ isPaid: false, can: () => false });
+    expect(isViewHidden('audit-log', noAuditCommunity)).toBe(true);
+    expect(normalizeHiddenView('audit-log', noAuditCommunity)).toBe('dashboard');
+
+    expect(isViewHidden('audit-log', ctx({ isPaid: true, can: () => false }))).toBe(true);
+  });
+
   it('hides routing and secrets fleet tabs only after experimentalReady when off', () => {
     const loading = ctx({ experimental: false, experimentalReady: false });
     expect(isFleetTabHidden('routing', loading)).toBe(false);