fix(auth): enforce role boundaries on data quality and audit

The data-quality workbench (list, detail, defer, reject) and the audit trail
had no role gate at all beyond authentication -- confirmed live, a Rental
Employee session could list and resolve data-quality issues and read the
full audit trail through both the API and the UI, with only merge-customers
and scan already restricted.

Per the role matrix, both areas are Operations-Manager-only. Gate the
remaining data-quality and audit endpoints with require_operations_manager,
hide their nav items for Rental Employee, show the same restricted-message
pattern Automation.tsx already used for direct URL access, and stop the
dashboard from linking into now-restricted areas for that role.

frontend/src/pages/DataQuality.tsx

@@ -2,6 +2,7 @@ import { useEffect, useState } from "react";
 import { Link } from "react-router-dom";
 import { api } from "../api/client";
 import type { DataQualityIssue } from "../api/types";
+import { useAuth } from "../context/AuthContext";
 import { SeverityBadge, StatusBadge } from "../components/Badge";
 import { EmptyState, ErrorState, LoadingState, PageHeader } from "../components/PageChrome";
 
@@ -14,12 +15,14 @@ const RULE_TYPES = [
 ];
 
 export function DataQuality() {
+  const { user } = useAuth();
   const [issues, setIssues] = useState<DataQualityIssue[] | null>(null);
   const [error, setError] = useState<string | null>(null);
   const [status, setStatus] = useState("open");
   const [ruleType, setRuleType] = useState("");
 
   useEffect(() => {
+    if (user?.role !== "operations_manager") return;
     setIssues(null);
     setError(null);
     const params = new URLSearchParams();
@@ -29,7 +32,16 @@ export function DataQuality() {
       .get<DataQualityIssue[]>(`/api/v1/data-quality/issues?${params.toString()}`)
       .then(setIssues)
       .catch(() => setError("Data-quality issues are unavailable right now."));
-  }, [status, ruleType]);
+  }, [status, ruleType, user]);
+
+  if (user?.role !== "operations_manager") {
+    return (
+      <div className="page">
+        <PageHeader eyebrow="Assurance / Workbench" title="Data quality" description="The quality workbench is visible to Operations Managers only." />
+        <p>Data-quality evidence and resolutions are visible to Operations Managers only.</p>
+      </div>
+    );
+  }
 
   return (
     <div className="page">