access-module-permissions

From the product owner, after a pass through Settings → Access:

> Members can be given View or Edit on each module, but right now that only
> decides which pages they can open. Someone with View on a module can still
> change everything in it.

Make View on a module mean view-only:

- Every change to a module's data is refused on the server unless the
  signed-in member has Edit on the module it belongs to. That covers
  Lineups, Sites, Deal Pipeline, Equipment, Purchase Orders, Allocation, and
  the catalogs edited under Settings. It comes on top of the site, data and
  feature checks that already exist; it does not replace them.
- Admins are unaffected. Members keep reading and opening everything they
  could before: someone with only View on Sites can still click a lineup in
  a phase's lineup plan on the Sites page and land on that lineup's page.
  The app should read as read-only for a module they can only view.

Version History is the one place still keyed off a hard-coded email domain,
which is wrong: an email domain should never decide what someone can do.
Move it onto the access model. Only people who can see every site and every
data field may view it, whatever their email. Restoring also needs Edit on
Settings plus a new **Restore versions** feature grant that an admin can
assign in Settings → Access. Every existing member should get the new grant.

## Environment

PostgreSQL on localhost:5432 and the local database endpoint the app's
driver uses are running when you start, and the dev env files point at the
dev database.