feat(rbac): make Settings authorization permission-aware (#1738)

* feat(rbac): make Settings authorization permission-aware

Align Settings visibility and mutations with the existing permission matrix so Node Admin can edit node-scoped operational settings while system and credential surfaces stay Admin-protected.

* fix(rbac): tighten settings permission buckets and tests

Collapse settings key permission maps into one source of truth, and cover mixed PATCH atomicity plus image-update enabled writes.

* fix(rbac): tighten Settings scoped grants and CI assertions

Empty settings PATCH fails closed, node:manage is scoped to the active
node, system-only Settings stay hidden without system:settings, and
Check updates / webhooks mutate gates follow the permission matrix.

* fix(rbac): defer Settings section fallback until authz is ready

Keep deep links to permission-gated sections (e.g. license) intact while
can() is still fail-closed during permission metadata load.

* docs(settings): clarify Notifications channels vs routing authz

Channels use node:manage via /api/agents; routing and mute stay Admin-only.

docs/features/rbac.mdx

@@ -21,7 +21,7 @@ Sencho ships with five built-in roles that map to the permissions most operators
 | **Admin** | Full operator access: deploy, edit compose, manage users, configure nodes, view audit log, every system setting | Community |
 | **Viewer** | Read-only access to stacks, logs, stats, file contents, and node listings | Community |
 | **Deployer** | Deploy, restart, stop, and start stacks. Cannot edit compose files, create or delete stacks, or view nodes | Admiral |
-| **Node Admin** | Full stack and node management across the fleet. No access to system settings, users, or license | Admiral |
+| **Node Admin** | Full stack and node management across the fleet, including node-scoped operational Settings. No access to users, licensing, credentials, or system-only Settings | Admiral |
 | **Auditor** | Read-only access to stacks, nodes, and the audit log. No write access anywhere | Admiral |
 
 ### Permission matrix
@@ -138,7 +138,7 @@ Scoped assignments are **additive only**. A Viewer with a scoped Deployer on `fr
 
 - A **Viewer** with a scoped **Deployer** assignment on the `frontend` stack at node `prod` can deploy, restart, and stop only that stack on `prod`. The same name on another node needs its own grant. They cannot edit compose or delete it.
 - A **Deployer** with a scoped **Node Admin** assignment on node `staging-server` can manage every stack and node operation on that server, while keeping plain Deployer rights on the rest of the fleet.
-- A **Node Admin** without any scoped assignments has full stack and node management across every node, but still cannot reach system settings, the user list, or the audit log.
+- A **Node Admin** without any scoped assignments has full stack and node management across every node, including node-scoped operational Settings, but still cannot reach users, licensing, credentials, or system-only Settings.
 
 ## Two-factor reset
 

docs/reference/settings.mdx

@@ -207,7 +207,7 @@ Create and manage user accounts with role-based access. The masthead publishes a
 | **Admin** | Community | Full access to all features |
 | **Viewer** | Community | Read-only access to stacks and nodes |
 | **Deployer** | Admiral | Can view stacks and trigger deployments |
-| **Node Admin** | Admiral | Full stack and node management, no system settings |
+| **Node Admin** | Admiral | Full stack and node management, including node-scoped operational Settings |
 | **Auditor** | Admiral | Read-only plus audit log access |
 
 See [RBAC & User Management](/features/rbac) for details on what each role can access.