feat(timeline): gate the EventPill edit pencil behind canWrite

Thread a gate-closed canWrite prop through TimelineView -> YearBand ->
EventPill and the undated bucket so a Reader never sees a dead-end edit
link. canEdit now also requires canWrite; the default false keeps an
un-threaded caller closed. The real boundary stays the #781 route guard
plus the backend permission -- this only hides the link.

Refs #842
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/timeline/EventPill.svelte

@@ -10,9 +10,11 @@ type TimelineEntryDTO = components['schemas']['TimelineEntryDTO'];
  * Centered axis pill for a derived life-event or a curated PERSONAL event
  * (REQ-007/008). The glyph is wrapped aria-hidden with an sr-only label sibling
  * (REQ-018). An edit affordance shows only for a curated event with an eventId
- * (never derived, never null — REQ-008).
+ * (never derived, never null — REQ-008) and only for a curator who holds
+ * WRITE_ALL (`canWrite`, gate-closed by default — #842 REQ-005/007/008). The
+ * gate is UX only; the real boundary is the #781 route guard + backend permission.
  */
-let { entry }: { entry: TimelineEntryDTO } = $props();
+let { entry, canWrite = false }: { entry: TimelineEntryDTO; canWrite?: boolean } = $props();
 
 const config = $derived(getAccentConfig(entry));
 const dateLabel = $derived(timelineDateLabel(entry.eventDate, entry.precision, entry.eventDateEnd));
@@ -24,7 +26,7 @@ const provenance = $derived(
 // Provenance always shows; the date is an optional prefix so an undated event
 // still reads "abgeleitet"/"kuratiert" (REQ-007).
 const subtitle = $derived(dateLabel ? `${dateLabel} · ${provenance}` : provenance);
-const canEdit = $derived(!entry.derived && entry.eventId != null);
+const canEdit = $derived(canWrite && !entry.derived && entry.eventId != null);
 </script>
 
 <div class="flex justify-center">