Consistently use server-side logic to determine permissions in the front-end

There are some places in the UI where we determine whether the current user has edit permissions, based on the contents of the `teamPermissions`. Examples:

https://github.com/google/peoplemath/blob/f56a7b6887f24623cb62c51e3dc24f45f81fc578/src/app/period/period.component.ts#L284
https://github.com/google/peoplemath/blob/f56a7b6887f24623cb62c51e3dc24f45f81fc578/src/app/teamperiods/teamperiods.component.ts#L83

This duplicates logic on the server side. For example, we need to look at `environment.requireAuth` to decide whether the server will even try to do any authentication at all.

There are places where we do make this kind of determination based on server-side logic, such as `canAddTeam` on the team list:

https://github.com/google/peoplemath/blob/5d7a3c721e75d5bfde5f58132ffcc9f7d0542f2c/backend/controllers/team.go#L70

We should use this technique consistently.

This may require backwards-incompatible changes to the JSON API, namely adding a wrapper object that contains the permissions and the team itself. But this is fine, as the backend is tightly coupled to the frontend at the moment (there is no mobile app whose versions can skew). We already made such a change to the team list.

Start with the permission checks in src/app/period/period.component.ts and src/app/teamperiods/teamperiods.component.ts, then compare them with canAddTeam in backend/controllers/team.go and the environment.requireAuth behavior. Identify the other UI checks that duplicate server-side permission logic, update the JSON API and frontend consistently, and verify that permission decisions come from the server response.

Written by the indexing model from the issue text.