feat(auth): disable write affordances for viewer role

src/pages/Inbox.tsx

@@ -18,6 +18,7 @@ import {
   resubmitRejectedWithDownload,
 } from "@/lib/inbox-api";
 import { downloadBlob } from "@/lib/download";
+import { RoleGate } from "@/auth/RoleGate";
 
 type LaneKey = "rejected" | "candidates" | "unmatched" | "done_today";
 
@@ -202,21 +203,31 @@ export default function Inbox() {
         />
       </main>
 
-      {/* Per-lane bulk bars. Each shows when its lane has a selection. */}
-      <BulkBar
-        lane="rejected"
-        count={selected.rejected.length}
-        onResubmit={onResubmit}
-        onDismiss={() => {}}
-        onExport={() => onExport("rejected")}
-      />
-      <BulkBar
-        lane="candidates"
-        count={selected.candidates.length}
-        onResubmit={() => {}}
-        onDismiss={onDismiss}
-        onExport={() => onExport("candidates")}
-      />
+      {/* Per-lane bulk bars. Each shows when its lane has a selection.
+          The two write-affordance BulkBars (rejected → resubmit,
+          candidates → dismiss) are gated by RoleGate so a viewer-role
+          account can still SEE the rows and select them but cannot
+          trigger a state change. The export buttons live inside the
+          same BulkBar component but are read-only, so we let them
+          remain visible to viewers. */}
+      <RoleGate allow={["admin", "user"]} fallback={null}>
+        <BulkBar
+          lane="rejected"
+          count={selected.rejected.length}
+          onResubmit={onResubmit}
+          onDismiss={() => {}}
+          onExport={() => onExport("rejected")}
+        />
+      </RoleGate>
+      <RoleGate allow={["admin", "user"]} fallback={null}>
+        <BulkBar
+          lane="candidates"
+          count={selected.candidates.length}
+          onResubmit={() => {}}
+          onDismiss={onDismiss}
+          onExport={() => onExport("candidates")}
+        />
+      </RoleGate>
       <BulkBar
         lane="unmatched"
         count={selected.unmatched.length}