feat(repo): hide write UI for users without push access

Fetch the viewer's push permission via GET /repos/{owner}/{repo} when
entering a repo and gate every write affordance behind it: edit and
image-upload buttons in StackedNote, new-fleeting-note and YouTube
buttons in FleetingNotes, and interactive checkboxes in TodoNotes
(rendered disabled when read-only). Anonymous viewers get the same
treatment because the permissions field is absent without auth, which
collapses to canPush = false.

Previously every write button was visible regardless of role, so
read-role collaborators and anonymous viewers could enter edit mode and
type before the save failed with 401/403.

src/views/TodoNotes.vue

@@ -26,9 +26,10 @@ const todoNote = computed(() =>
 const sha = computed(() => todoNote.value?.sha ?? "")
 const path = computed(() => todoNote.value?.path)
 
+const canPush = computed(() => store.canPush)
+
 const { toHTML } = markdownBuilder(repo)
 
-// Setup checkbox commit handler
 const { pendingContent, syncContent, listenToCheckboxes, hasPendingChanges } =
   useCheckboxCommit({
     user: props.user,
@@ -37,7 +38,8 @@ const { pendingContent, syncContent, listenToCheckboxes, hasPendingChanges } =
     initialContent: "",
     initialSha: sha,
     containerSelector: ".todo-notes .note-display",
-    debounceMs: 1000
+    debounceMs: 1000,
+    enabled: canPush
   })
 
 // Render pending content to HTML for display
@@ -64,9 +66,9 @@ watch(
   { immediate: true }
 )
 
-// Setup checkbox listeners when content renders
+// Setup checkbox listeners when content renders or canPush changes
 watch(
-  renderedContent,
+  [renderedContent, canPush],
   async () => {
     await nextTick()
     listenToCheckboxes()