fix(audit): permission UI gates + preflight leak (R2-H6/H7/H8/H9 + R2-M9)

R2-H6: webhook-delivery-log Replay column was rendered for any user
who could load the page; the route gates on admin.manage_webhooks.
Now the entire Replay column is hidden when the user lacks the perm.

R2-H7: Bulk Archive action was visible to sales_agent + viewer
(clients.delete:false). Now wrapped in canBulkArchive (clients.delete).

R2-H8: Bulk Add tag / Remove tag were visible to viewer (clients.edit:
false). Now wrapped in canBulkTag (clients.edit).

R2-H9: bulk-hard-delete silently dropped clients that became
unarchived between preflight and execute. The service now returns
{deletedCount, skipped[]} and the dialog stays open on partial
success showing the per-row reason table — operators can see exactly
which IDs were skipped and why.

R2-M9: bulk-archive-preflight catch block was leaking dossier-loader
error messages, letting an attacker enumerate "not found" vs "exists
in another port". Replaced with a generic 'Could not load dossier —
client may have been removed' blocker.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/admin/webhooks/webhook-delivery-log.tsx

@@ -14,6 +14,7 @@ import {
   TableRow,
 } from '@/components/ui/table';
 import { apiFetch } from '@/lib/api/client';
+import { usePermissions } from '@/hooks/use-permissions';
 
 interface Delivery {
   id: string;
@@ -42,6 +43,8 @@ export function WebhookDeliveryLog({ webhookId }: Props) {
   const [page, setPage] = useState(1);
   const [loading, setLoading] = useState(true);
   const [retrying, setRetrying] = useState<string | null>(null);
+  const { can } = usePermissions();
+  const canReplay = can('admin', 'manage_webhooks');
 
   async function retry(deliveryId: string) {
     setRetrying(deliveryId);
@@ -98,7 +101,7 @@ export function WebhookDeliveryLog({ webhookId }: Props) {
             <TableHead>HTTP</TableHead>
             <TableHead>Attempt</TableHead>
             <TableHead>Time</TableHead>
-            <TableHead className="w-16 text-right">Replay</TableHead>
+            {canReplay && <TableHead className="w-16 text-right">Replay</TableHead>}
           </TableRow>
         </TableHeader>
         <TableBody>
@@ -115,22 +118,24 @@ export function WebhookDeliveryLog({ webhookId }: Props) {
                   ? new Date(d.deliveredAt).toLocaleString()
                   : new Date(d.createdAt).toLocaleString()}
               </TableCell>
-              <TableCell className="text-right">
-                {(d.status === 'failed' || d.status === 'dead_letter') && (
-                  <Button
-                    variant="ghost"
-                    size="sm"
-                    disabled={retrying === d.id}
-                    onClick={() => retry(d.id)}
-                    title="Replay this delivery"
-                    aria-label="Replay this delivery"
-                  >
-                    <RotateCcw
-                      className={`h-3.5 w-3.5 ${retrying === d.id ? 'animate-spin' : ''}`}
-                    />
-                  </Button>
-                )}
-              </TableCell>
+              {canReplay && (
+                <TableCell className="text-right">
+                  {(d.status === 'failed' || d.status === 'dead_letter') && (
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      disabled={retrying === d.id}
+                      onClick={() => retry(d.id)}
+                      title="Replay this delivery"
+                      aria-label="Replay this delivery"
+                    >
+                      <RotateCcw
+                        className={`h-3.5 w-3.5 ${retrying === d.id ? 'animate-spin' : ''}`}
+                      />
+                    </Button>
+                  )}
+                </TableCell>
+              )}
             </TableRow>
           ))}
         </TableBody>