Apps detect read-only credentials and disable the Uploader and Tagger

Someone handed a read-only credential can still open the Uploader, pick files, fill in metadata and start an upload. It fails partway through with a raw S3 error. The apps should tell them up front that this credential can read but not write, grey out the Uploader and the Tagger with that message, and leave the Explorer fully usable.

Where:

- `docs/requirements-draft/gap-report.md:301-304`: the permission model does not exist, access is whatever the S3 credential allows
- `packages/s3-safe/src/index.ts:139-145` maps 412 and 501 to typed errors and passes 403 through untouched
- `packages/s3-safe/src/index.ts:361` `writeImmutable` is the conditional-put path a probe could use
- `apps/sparcd-home/index.html` is the launcher that lists all three apps

What to do:

S3 has no "what may I do" call, so this has to be inferred. Two options:

- Probe on connect: PUT a zero-byte key under the collection prefix, delete it after. Definite answer before the user invests any work. Use a conditional PUT where the provider supports it and fall back to a plain PUT where it returns 501, which `s3-safe` already detects.
- Wait for the first 403 on a real write and treat that as the signal. No extra traffic, but the user only finds out mid-upload.

I recommend the probe, because the whole point is telling people before they spend an hour selecting files. Teams that object to any write on connect can override that.

Whatever the design, it must work the same on any S3-compatible provider. No provider-specific policy or IAM calls, only the standard S3 verbs and their status codes.

1. Add a capability check to the shared connection path and store the result.
2. Map 403 and AccessDenied to a typed error in `s3-safe` so both apps can act on it.
3. Gate the Uploader and Tagger entries on the launcher and inside each app.

Done when:

- [ ] Read-only credential greys out the Uploader and Tagger with a plain message
- [ ] The Explorer still works on a read-only credential
- [ ] No probe object is left behind
- [ ] A 403 mid-write surfaces as the same message, not a raw SDK error

Related: #203 permissions matrix in CI, CulverLab/sparcd-requirements#37 operator user story, #198 meeting notes. This one is ahead of its requirement, there is no story yet describing what permission levels exist.

Serves user story: T2, M2, RAJ1