bug(rbac): action buttons (write/delete/approve) not correctly gated by per-resource permissions for all groups (regression after #660/PR #891)

[cristim]

Repro

1. Log in with different group permission sets (e.g., Read-Only, Plan Authors, Standard User, Viewer).
2. Navigate to Opportunities, Plans, and Purchases.
3. Observe action buttons (Purchase, Plan, Approve, Cancel, Retry, Edit, Delete).

Expected

Action buttons are visible only to users whose role has the corresponding per-resource write permission. For example:

• Read-Only users see no action buttons anywhere.
• Plan Authors see Plan and Create Plan buttons, but not Purchase buttons.
• Viewers see no action buttons.

Actual

Some action buttons are visible for roles that should not see them. The per-resource gating introduced by #660/PR #891 is not consistently enforced across all role/button combinations.

Context

Issue #660 ('feat(api/auth): finer-grained per-role write permissions') was closed as fixed by PR #891. QA marked the verification row as Fail after the PR merged. Re-test needed across all role/button combinations to identify remaining gaps.

Note: Specific confirmed cases tracked separately:

• Plan Authors seeing Add Purchase button: issue bug(rbac): Plan Authors role: 'Add Purchase' button visible in Plans (user can schedule purchases without permission) #1406
• Approve button for own submissions shown to non-approver roles: issue bug(rbac): Approve button shown for user's own queued purchases in roles without approve-any permission #1407

Sheet reference

Bugs and improvement suggestions tab, row 522.