Hide add-member / change-role controls on open collections from non-stakeholders (cloud now refuses them) #3294

Since cloud PR #198 (ADR-037 §2a, live after the 09-29 rollout), only a collection's creator or an active tenant owner/tenant_admin may add another person to an open collection (or change their tier); everyone else gets 42501. The desktop collaboration-view still shows the add-member and change-role controls to non-stakeholders, so they hit "permission denied".

Do: gate those controls on open collections to stakeholders (creator = the collection node's created_by matches the signed-in uid, or the user is an active tenant owner/tenant_admin — the tenant role is available via ListTenantMembers, as the admissions card in #3291 already does). On restricted collections keep today's rule (collection admins). Self-join stays available to everyone. Map any residual 42501 to an actionable message.

🤖 Generated with Claude Code