fix(auth): enforce role boundaries on data quality and audit

The data-quality workbench (list, detail, defer, reject) and the audit trail
had no role gate at all beyond authentication -- confirmed live, a Rental
Employee session could list and resolve data-quality issues and read the
full audit trail through both the API and the UI, with only merge-customers
and scan already restricted.

Per the role matrix, both areas are Operations-Manager-only. Gate the
remaining data-quality and audit endpoints with require_operations_manager,
hide their nav items for Rental Employee, show the same restricted-message
pattern Automation.tsx already used for direct URL access, and stop the
dashboard from linking into now-restricted areas for that role.

frontend/src/pages/DataQualityIssueDetail.tsx

@@ -167,6 +167,7 @@ function DuplicateCustomerPanel({ issue, onResolved }: { issue: IssueDetail; onR
 }
 
 export function DataQualityIssueDetail() {
+  const { user } = useAuth();
   const { publicRef } = useParams<{ publicRef: string }>();
   const [issue, setIssue] = useState<IssueDetail | null>(null);
   const [error, setError] = useState<string | null>(null);
@@ -181,10 +182,11 @@ export function DataQualityIssueDetail() {
   }, [publicRef]);
 
   useEffect(() => {
+    if (user?.role !== "operations_manager") return;
     setIssue(null);
     setError(null);
     load();
-  }, [load]);
+  }, [load, user]);
 
   async function handleAction(action: "defer" | "reject") {
     if (!issue) return;
@@ -197,6 +199,15 @@ export function DataQualityIssueDetail() {
     }
   }
 
+  if (user?.role !== "operations_manager") {
+    return (
+      <div className="page">
+        <PageHeader eyebrow="Assurance / Workbench" title="Data quality issue" description="The quality workbench is visible to Operations Managers only." />
+        <p>Data-quality evidence and resolutions are visible to Operations Managers only.</p>
+      </div>
+    );
+  }
+
   if (error) return <ErrorState message={error} />;
   if (!issue) return <LoadingState label="Loading issue evidence…" />;