Add regression coverage for ACL diagnostics for enabled clusters without accounts

## Problem
The current test suite does not cover ACL diagnostics for enabled clusters without accounts.

## Expected behavior
- A focused Vitest case locks the existing behavior.
- The targeted test file passes and fails if the covered behavior regresses.

## Scope
Only add regression coverage for $(@{Slug=acl-no-accounts; Focus=ACL diagnostics for enabled clusters without accounts; PrTitle=test(acl): cover enabled ACL with no plain access accounts; TestFile=web/src/utils/aclRiskDiagnostics.test.ts; Mode=existing; Append=describe('ACL risk diagnostics missing accounts', () => {
it('flags an enabled ACL with no plain access accounts as critical', () => {
const diagnostics = analyzeAclRisk(config({ accounts: [], accountCount: 0 }));

expect(diagnostics.summary.accountCount).toBe(0);
expect(diagnostics.issues.map((issue) => issue.code)).toContain('NO_PLAIN_ACCESS_ACCOUNTS');
});
});}.TestFile). No runtime behavior changes.

## Acceptance criteria
- [ ] The targeted Vitest file passes.
- [ ] git diff --check is clean.

Start with web/src/utils/aclRiskDiagnostics.test.ts and review its existing Vitest cases for ACL diagnostics. Run the targeted test file, then confirm the enabled-cluster/no-accounts regression is covered, the file passes, and git diff --check is clean.

Written by the indexing model from the issue text.