Collectors Settings shows the initial setup form to users who cannot create the ingest input

## Summary

On a cluster without a collectors config yet, the Collectors **Settings** page shows the full "Getting started" setup form to a user who cannot create inputs (e.g. Reader + built-in **Collectors Manager** role). The user can fill in the ingest endpoint and click "Confirm settings", the config is saved, but no ingest input is created and nothing tells them so. The result looks like a completed setup that can never receive data.

## Steps to reproduce

1. Fresh cluster (no `org.graylog.collectors.CollectorsConfig` in `cluster_config`).
2. Log in as a user with the Reader and Collectors Manager roles (no `inputs:create`).
3. Open **System → Collectors → Settings**.

## Expected

The page should say up front that an administrator needs to create the Collector Ingest input, instead of presenting a form that cannot complete the setup. The onboarding wizard on the Overview page already does this (see `FirstOnboarding`, gate on `canCreateIngestInput` from `useCollectorPermissions`).

## Actual

- `CollectorsSettings` only hides the "Create ingest input" checkbox (`showCreateInputCheckbox` requires input permissions) but keeps the form and the submit button.
- The "Getting started with Collectors" alert still says "Configure the HTTP endpoint below and save to initialize the collector infrastructure".
- `IngestEndpointStatus` returns `null` while `isInitialSetup && !hasInputs`, so the missing input is never mentioned.

## Notes

- Same root cause as the onboarding gate: the ingest input is a regular input, and the Collectors Manager role does not include `inputs:create` / `input_types:create:org.graylog.collectors.input.CollectorIngestHttpInput` (`CollectorsPermissions#builtinRoles`).
- Related: changing the external port on the Settings page does not move an existing ingest input either. The onboarding strip now does this via `updateCollectorInputPort` in `useCollectorInputMutations`; the Settings page could reuse it.

Start with CollectorsSettings and IngestEndpointStatus, then compare the permission gate in FirstOnboarding and canCreateIngestInput from useCollectorPermissions. Verify the Settings page behavior for a user without input-creation permissions: it should explain that an administrator must create the Collector Ingest input instead of presenting an apparently completable setup.

Written by the indexing model from the issue text.