fix(audit): permission UI gates + preflight leak (R2-H6/H7/H8/H9 + R2-M9)

R2-H6: webhook-delivery-log Replay column was rendered for any user
who could load the page; the route gates on admin.manage_webhooks.
Now the entire Replay column is hidden when the user lacks the perm.

R2-H7: Bulk Archive action was visible to sales_agent + viewer
(clients.delete:false). Now wrapped in canBulkArchive (clients.delete).

R2-H8: Bulk Add tag / Remove tag were visible to viewer (clients.edit:
false). Now wrapped in canBulkTag (clients.edit).

R2-H9: bulk-hard-delete silently dropped clients that became
unarchived between preflight and execute. The service now returns
{deletedCount, skipped[]} and the dialog stays open on partial
success showing the per-row reason table — operators can see exactly
which IDs were skipped and why.

R2-M9: bulk-archive-preflight catch block was leaking dossier-loader
error messages, letting an attacker enumerate "not found" vs "exists
in another port". Replaced with a generic 'Could not load dossier —
client may have been removed' blocker.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/clients/client-list.tsx

@@ -51,6 +51,8 @@ export function ClientList() {
 
   const { can } = usePermissions();
   const canHardDelete = can('admin', 'permanently_delete_clients');
+  const canBulkArchive = can('clients', 'delete');
+  const canBulkTag = can('clients', 'edit');
 
   const {
     data,
@@ -161,33 +163,41 @@ export function ClientList() {
           isLoading={isFetching && !isLoading}
           getRowId={(row) => row.id}
           bulkActions={[
-            {
-              label: 'Add tag',
-              icon: TagIcon,
-              onClick: (ids) => {
-                if (ids.length === 0) return;
-                setTagChoice([]);
-                setTagDialog({ ids, mode: 'add' });
-              },
-            },
-            {
-              label: 'Remove tag',
-              icon: TagsIcon,
-              onClick: (ids) => {
-                if (ids.length === 0) return;
-                setTagChoice([]);
-                setTagDialog({ ids, mode: 'remove' });
-              },
-            },
-            {
-              label: 'Archive',
-              icon: Archive,
-              variant: 'destructive',
-              onClick: (ids) => {
-                if (ids.length === 0) return;
-                setBulkArchiveIds(ids);
-              },
-            },
+            ...(canBulkTag
+              ? [
+                  {
+                    label: 'Add tag',
+                    icon: TagIcon,
+                    onClick: (ids: string[]) => {
+                      if (ids.length === 0) return;
+                      setTagChoice([]);
+                      setTagDialog({ ids, mode: 'add' });
+                    },
+                  },
+                  {
+                    label: 'Remove tag',
+                    icon: TagsIcon,
+                    onClick: (ids: string[]) => {
+                      if (ids.length === 0) return;
+                      setTagChoice([]);
+                      setTagDialog({ ids, mode: 'remove' });
+                    },
+                  },
+                ]
+              : []),
+            ...(canBulkArchive
+              ? [
+                  {
+                    label: 'Archive',
+                    icon: Archive,
+                    variant: 'destructive' as const,
+                    onClick: (ids: string[]) => {
+                      if (ids.length === 0) return;
+                      setBulkArchiveIds(ids);
+                    },
+                  },
+                ]
+              : []),
             ...(canHardDelete
               ? [
                   {