refactor(layout): extract canUpload derived for the upload-button gate (#696)

Move the inline {#if data?.user && data.canWrite} condition into a named
$derived, matching the existing isAdmin / isAuthPage derivations in the
same file. No behaviour change — the 11 layout specs stay green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/+layout.svelte

@@ -43,6 +43,8 @@ const isAdmin = $derived(
 	data?.user?.groups?.some((g: { permissions: string[] }) => g.permissions.includes('ADMIN'))
 );
 
+const canUpload = $derived(Boolean(data?.user && data.canWrite));
+
 // Set after client-side hydration completes. Used by E2E tests to know the
 // page is interactive (event handlers registered) before they interact with it.
 let hydrated = $state(false);
@@ -75,7 +77,7 @@ const userInitials = $derived.by(() => {
 
 					<!-- Right Side -->
 					<div class="flex items-center gap-3">
-						{#if data?.user && data.canWrite}
+						{#if canUpload}
 							<a
 								href="/documents/new"
 								aria-label={m.upload_action()}