fix: require node:read for fleet topology reads and hide Fleet without it (#1507)

The fleet overview, configuration, dependency-map, and networking-summary reads
were authentication-only, so a role without node:read (deployer) could read node
names, host stats, and cross-node topology. They now require node:read, matching
the role model where every role except deployer holds it.

For parity, the Fleet nav entry is gated on node:read (hiding it from the top
nav, mobile menu, and command palette), the Fleet view redirects to the
dashboard when reached without it, and the dashboard fleet heartbeat falls back
to the single-node restart map for a role that cannot read fleet data.

frontend/src/components/EditorLayout.tsx

@@ -806,6 +806,11 @@ export default function EditorLayout() {
               />
             );
           case 'fleet':
+            // Never mount the mobile fleet view without node:read: the redirect
+            // effect bounces the deep-link to the dashboard, but MobileFleet is a
+            // static (non-lazy) render, so without this guard it would fire one
+            // /fleet/overview (now 403) before the redirect unmounts it.
+            if (!can('node:read')) return null;
             return (
               <MobileFleet
                 headerActions={mobileMastheadActions}