Add CalendarClock icon, planner/settings capabilities

- backend/src/auth.js: extract caps from JWT (planner/settings), hasCap/requireCap
- backend/src/routes/config.js: gate categories + test-connection on requireCap('settings')
- frontend/src/types.ts: add caps[] to User, export can() helper
- frontend/src/App.tsx: gate /settings route on can(user, 'settings')
- frontend/src/components/Layout.tsx: gate nav item on can(user, 'settings')

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/Layout.tsx

@@ -1,5 +1,6 @@
 import { NavLink } from 'react-router-dom'
 import { CalendarClock, Settings, LogOut } from 'lucide-react'
+import { can } from '../types'
 import type { User } from '../types'
 
 interface Props {
@@ -30,7 +31,7 @@ export function Layout({ user, children }: Props) {
 
         <div style={{ flex: 1, padding: '0.5rem 0', overflowY: 'auto' }}>
           <NavItem to="/planner" icon={CalendarClock} label="Planner" />
-          {user.is_admin && <NavItem to="/settings" icon={Settings} label="Category Settings" />}
+          {can(user, 'settings') && <NavItem to="/settings" icon={Settings} label="Category Settings" />}
         </div>
 
         <div style={{ padding: '0.75rem 1rem', borderTop: '1px solid var(--surface-2)' }}>