feat(settings): complete #802 settings API integration gaps

[vbeni30]

Summary

• Gate settings navigation tabs by backend permissions
• Surface tag load failures instead of showing silent empty lists
• Remove the /settings legacy rewrite so the Next.js page is canonical
• Add frontend tests for the API client, server actions, and settings panels (reads, writes, validation, forbidden)

Test Plan

• pnpm run frontend:typecheck
• Vitest settings suite (45 tests)
• dotnet test SettingsApiController (4 tests)

[Seme30]

Looks like the remaining #802 integration pass: permission-gated tabs, tag load errors, /settings rewrite removed, and tests for reads/writes/validation/forbidden. CI is green.

P2

• frontend/app/settings/page.tsx:44-63 still Promise.alls every settings endpoint, including tabs the user cannot see. Users without Manage Global Site Settings / role-edit permissions will get a burst of 403s on every page load. Fetch only the panels the nav will show.

• frontend/app/settings/layout.tsx:78 falls back to defaultTab = "roles" when navItems is empty, so a user with no settings permissions can still land on a hidden roles panel.

Not blocking merge for the #802 gaps this PR claims, but please fix the 403 fan-out if you touch the page again. This does not close #801 (/users/settings is still rewritten).

[Seme30]

Addressed by the last commit 7e9ef42 (7e9ef42).

The earlier P2 notes are covered: settings SSR now fetches only permission-visible panels, and users with no settings access get an empty state instead of a hidden roles tab. Ready for merge.