feat(auth): disable write affordances for viewer role

src/pages/Inbox.test.tsx

@@ -5,6 +5,17 @@ import Inbox from "./Inbox";
 import * as inboxApi from "@/lib/inbox-api";
 import * as downloadModule from "@/lib/download";
 
+// The Inbox page now gates the Resubmit/Dismiss BulkBars behind
+// <RoleGate allow={["admin", "user"]}>. Tests need an "admin"
+// principal so the bulk bar still renders — otherwise the
+// SP8 resubmit-with-download assertion below has nothing to click.
+vi.mock("@/auth/useAuth", () => ({
+  useAuth: () => ({
+    user: { id: 1, username: "test-admin", role: "admin" },
+    status: "authenticated",
+  }),
+}));
+
 afterEach(() => {
   cleanup();
   vi.unstubAllGlobals();