fix(conversations): hide new document link for read-only users

The link navigates to a page that requires WRITE_ALL. Guard it with
data.canWrite (supplied by the layout) so read-only users never see a
link that leads to a 403.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/conversations/+page.svelte

@@ -225,6 +225,7 @@ const enrichedDocuments = $derived(
 					{data.documents.length}
 				</p>
 			{/if}
+			{#if data.canWrite}
 				<a
 					data-testid="conv-new-doc-link"
 					href="/documents/new?senderId={senderId}&receiverId={receiverId}"
@@ -236,6 +237,7 @@ const enrichedDocuments = $derived(
 					</svg>
 					{m.conv_new_doc_link()}
 				</a>
+			{/if}
 		</div>
 
 		<!-- CHAT CONTAINER -->