Move diagnostics to an Owner and Admin page

[Kevinjohn]

Part of #1408 (T16). Merge predecessor: #1419 (this PR's base branch).

• New /diagnostics page for Owners and Admins (auth-off demo allowed; Editors and Viewers redirected), listed after Settings in the sidebar and the command palette from one access decision.
• The copied report adds the sign-in mode, this session's save counters and browser facts (user agent, viewport, time zone, language) to the build and server status. It carries no names, emails, ids, tokens, host URLs or company data; a user agent carrying a URL or email is dropped.
• Settings keeps Build details (stamp and Send feedback) for every role; the Diagnostics row and Copy action move to the new page.

Validation: integrated with the rest of Batch 2 and Batch 3 (T7, T15, T6, T8, T16) on 84ae32e7 over origin/main da72918: pnpm run gate:all and pnpm run e2e (290 tests) pass on Node 24.16.0. Independently reviewed before E2E; review findings fixed.

Merge order

1. Route support to Discussions and remove PR screenshots #1411, Add project status, comparison, testing and philosophy pages #1412, Archive changelog sections before 0.41.0-alpha.3 #1414 (independent)
2. Add a first-change path for contributors #1413 (after Archive changelog sections before 0.41.0-alpha.3 #1414), Restate the comment standard as numbered voice rules #1415, Reduce configuration and hide password MFA #1416
3. Rename SMALLSASS_ACCOUNT_ settings to CAPACITYLENS_ #1417 → Add an init command that writes the environment file #1418
4. Retire unused settings and derive engagement grouping #1419 → Move diagnostics to an Owner and Admin page #1420 → Reshape the documentation into four role guides #1421 → Use @/ for app imports that leave their folder #1422 → Consolidate server test scaffolding #1423 → Normalise server route handlers and reply messages #1424 → Apply the comment-voice rules and check them in the gate #1425 (Apply the comment-voice rules and check them in the gate #1425 also after Restate the comment standard as numbered voice rules #1415) → Name the tenant boundary account in code #1426

Merge predecessor for this PR: #1419.

[Kevinjohn]

Polish review: no P1/P2 findings.

• Report privacy checked field by field. Every value is enum- or pattern-projected, and fetch errors are never rendered. The page mounts only after the access decision, so nothing flashes before the redirect.
• GET /api/diagnostics still answers any signed-in member, as it did before this PR. The payload is instance-level only (schema version, backup status, no company data), so the page restriction is a presentation choice, not a data boundary.
• Ladder passes on Node 24: format, lint, typecheck, file sizes, server tsc, and 178 app test files.
• Simplification: formatDiagnostics now uses the existing UNKNOWN constant.

Merge order for this batch: #1411, #1412, #1414 → #1413, #1415, #1416 → #1417 → #1418, #1419 → #1420 → #1421 → #1422 → #1423 → #1424 → #1425 → #1426. Predecessor: #1419.