fix: restrict app cloning for read-only users

[tlokeshrao]

Description

Prevent read-only users from cloning regular apps and projects while preserving cloning for agents and skills. Keep catalog action controls visually aligned when no overflow actions are available.

Changes Made

• Hide Clone for read-only users on regular project types (CODE, BLOCKS, and INSIGHT).
• Continue showing Clone for agents (WORKSPACE) and skills.
• Require owner/editor permission for regular-project clone actions in the catalog, including bookmarked, personal, and discoverable views.
• Reserve the overflow-action slot on catalog cards and show a muted, disabled vertical-ellipsis button when no actions are available.

How to Test

1. Open the App catalog as a read-only user and verify regular apps do not offer Clone.
2. Verify owner/editor users can still clone regular apps.
3. Verify read-only users can still clone agents and skills.
4. Compare catalog cards with and without overflow actions and verify the action icons remain aligned; unavailable overflow actions should appear disabled.

Validation

• Biome checks pass for the touched frontend files.

Notes

The backend authorization guard is implemented in the companion Semoss repository change on the matching fix/project-clone-permissions branch.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.