Replace in-app Access Control with JWT cap enforcement

The in-app page-restriction system (admin-only toggles in Settings) was
nav-hiding only and duplicated functionality already covered by JWT caps
in the main stack auth service. All 9 pages in the restriction list were
already gated in Layout.tsx by existing caps.

Backend: add router-level requireCap() to enforce caps at the API layer:
- reports.py: Depends(require_cap("view"))
- logbook.py: Depends(require_cap("logbook"))
- search.py: Depends(require_cap("invoices"))

Frontend: remove the Access Control settings section entirely:
- Drop pageRestrictions query, restrictedPages/accessSaveMessage state,
  savePageRestrictionsMutation, isSectionAccessible helper
- Remove 'access' from SettingsSection type and sidebarItems
- Strip restrictPath from all sidebar items (no longer needed)

Access management is now fully centralised in the main stack auth service.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/reports.py

@@ -19,7 +19,7 @@ from models.newbook import NewbookDailyRevenue, NewbookGLAccount, NewbookDailyOc
 from models.cost_distribution import CostDistribution, CostDistributionEntry, DistributionStatus
 from auth import get_current_user, require_cap
 
-router = APIRouter()
+router = APIRouter(dependencies=[Depends(require_cap("view"))])
 
 
 class RevenueEntryCreate(BaseModel):