A locked page now tells you what you're missing, instead of crashing

Four related fixes to how a role's permissions show up in the dashboard, all part of the same cleanup:

• No more crash on a locked page. If your role was missing the right permission, opening General, Members, Agents, or Connectors directly used to land you on a generic error screen. All of these now show the same plain "you don't have permission" message instead, naming exactly which permission you're missing and pointing you to an administrator.
• The Settings sidebar (General, Members, Roles, API keys, Billing) and the main sidebar's Agents and Connectors entries now only show up if your role can see that area. An item you have no access to simply isn't there anymore, instead of leading to a locked page.
• A role with view-only access to Roles can now open a specific role's details and see its name, description, and permissions read-only. Previously this bounced you back to the roles list with no explanation.
• Billing now follows the same rule as every other Settings page. Opening it directly without the right permission used to show a generic "page not found"; it now shows the same "you don't have permission" message as everywhere else.

Nothing changes for Admin or for any role that already has full access; this only affects a role with a narrower, custom set of permissions.