fix(nav): gate Admin manage links by actual permission, not just role

Audit follow-up (UI P1). The page guards authorize feature management via
user_has_permission, but the Admin nav links were shown by role only:
a member with a delegated forms/certifications/classes/equipment/door
*.manage permission had no link (orphaned), and an admin lacking the
permission saw a link that redirected. The layout now resolves those five
permissions and the sidebar shows each link on (isAdmin || permission);
Customize/Import/Settings stay admin-only. Also: aria-label on the
forum delete button; comment the intentional Classes/Equipment
nav-active exact-match.

app/(app)/forum/[id]/thread-actions.tsx

@@ -65,6 +65,7 @@ export function ThreadActions({ threadId, pinned, locked, canModerate, isAuthor
           onClick={handleDelete}
           className="text-muted-foreground hover:text-red-500 transition p-1.5"
           title="Delete"
+          aria-label="Delete thread"
         >
           <Trash2 className="w-3.5 h-3.5" />
         </button>