feat(ui): confine read-only users to the transcription read view (#697)

On the document detail page, pass canEdit={canWrite} to the panel header,
guard onModeChange so a reader can never flip to edit, and default panelMode
to 'read' for readers. Thread canAnnotate={canWrite} through DocumentViewer
to PdfViewer so the annotation layer's canDraw (which also gates delete and
resize) is off for readers — they can open and read, but not draw, edit, or
delete. The writer-only OCR status check is also skipped for readers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/document/DocumentViewer.svelte

@@ -17,6 +17,7 @@ type Props = {
 	isLoading: boolean;
 	error: string;
 	transcribeMode?: boolean;
+	canAnnotate?: boolean;
 	blockNumbers?: Record<string, number>;
 	annotationReloadKey?: number;
 	activeAnnotationId: string | null;
@@ -33,6 +34,7 @@ let {
 	isLoading,
 	error,
 	transcribeMode = false,
+	canAnnotate = false,
 	blockNumbers = {},
 	annotationReloadKey = 0,
 	activeAnnotationId = $bindable(),
@@ -93,6 +95,7 @@ let {
 			url={fileUrl}
 			documentId={doc.id}
 			transcribeMode={transcribeMode}
+			canAnnotate={canAnnotate}
 			blockNumbers={blockNumbers}
 			annotationReloadKey={annotationReloadKey}
 			bind:activeAnnotationId={activeAnnotationId}