Permission checks move to the server, plus better failure screens

A round of unglamorous work that's worth writing down.

• Permission checks are enforced on the server. Front Desk write actions — badge assign, scan, quick check-in, undo, group check-in, session attendance — were gated in the interface but not behind it. The interface gates were a convenience; now the server is the real boundary. No role's day-to-day access changed.
• Fixed an error on household check-in. Checking in a household, and fanning a check-in out to a family during a session, could fail outright. That's repaired, and covered by tests so it stays repaired.
• Failed page loads show a page, not a blank. Members, Transportation, Engagement, Reporting, and Meals now show a "couldn't load this" card with a retry button when a request fails.
• A misconfigured deploy now fails loudly at startup rather than quietly pointing at nothing.

We also added coverage for Front Desk, Members, and Reporting — three of the most-used surfaces, which had the least.