[Agent] Viewer role sees write UI but RLS blocks actions

Agent brief

Category: bug | Severity: high | Effort: M

Problem

viewer org role can access admin UI and see create/edit buttons, but RLS blocks writes. Users get cryptic permission errors instead of read-only UI.

Repro

1. Invite user as Viewer
2. Open admin feedback, try to change status or create post
3. Action fails at DB layer

Files

• supabase/migrations/0035_viewer_role.sql — policy reference
• Admin components under src/components/admin/ and src/app/admin/
• Grep org_role, viewer, canWrite

Acceptance criteria

• Viewer sees read-only admin (no create/edit/delete controls)
• Write server actions return clear 403 before DB
• Tests for viewer cannot mutate

Suggested approach

Central useOrgPermissions() or server helper; gate buttons and routes.