Billing: gate the pages on owner OR admin, not owner alone

[pavlo-flamingo]

Billing was owner-only. It is now open to owners and admins — the role part of #137, ported on its own so it can land without the Billing redesign.

Admins run the workspace day to day: they add the devices the plan is sized for and they are the ones who hit the limits. Owners keep the money; admins need to see and change what it buys. Everyone else stays out — to a member, billing is neither useful nor theirs.

The gate

src/app/hooks/use-billing-access-gate.ts answers "may this viewer manage billing?" for every billing surface, in three states rather than two: loading | allowed | denied. Same discipline as the feature flags, for the same reason — "not answered yet" is not "no", and notFound() throws, so a page closed on a guessed denied never reopens once /me lands. Roles arrive as plain strings from the gateway (OWNER, ADMIN, …) with no schema enum behind them, so the comparison is case-insensitive, matching employee-details-view.tsx.

Callers switched: the Billing & Usage page, the plan picker page, the Settings hub card (billings === 'on' && access === 'allowed'), and the subscription lock screen.

use-owner-gate.ts stays, narrowed to what ownership actually decides — self-deletion, where handing the workspace over IS the point.

The refusal screen

BillingOwnerOnlyScreen → BillingRestrictedScreen: "owner-only" is no longer true. Copy now points at the owner and the admins, and the lock screen says "Only the workspace owner or an admin can restore it." The native wording still splits on isBillingHidden() and names no subscription or payment (App Store Guideline 3.1.1). A role refusal still explains itself instead of 404ing — the hub hides the card, so whoever lands here followed a bookmark or a shared link; a definitive billings === 'off' still 404s, since there the section genuinely does not exist for the tenant.

Not ported from #137

That PR also moves the role check past the lazy boundary into subscription-plan-lock-content.tsx, so that waiting on /me renders the paywall unpriced instead of the refusal. It depends on SubscriptionSettingsLoading, which arrives with the redesign; here loading stays grouped with the refusal, as the file already documents.

npm run type-check and Biome clean.