fix: gate task board/list write controls and add keyboard drag-reorder (#2069)

[larryro]

Summary

Resolves the two affordance defects on the Projects → Tasks board & list surface (#2069):

[57] Write controls exposed to read-only viewers

The board/list rendered the Create button and the inline priority/assignee pickers and allowed drag-reorder for everyone, even read-only viewers — the server correctly rejected the writes (assertTaskWritable → RBAC_FORBIDDEN), but the user only saw a generic failure toast. The task modal already gated these via disabled={!canEdit}; this brings the board/list to parity.

• listTasksByProject now returns canEdit (derived from the existing checkProjectAccess) in its return validator.
• Threaded through useTasksByProject → TasksWorkspace → KanbanBoard/TasksList → BoardColumn/TaskCard/TaskListRow.
• Read-only viewers: the Create button is hidden, the priority/assignee pickers render as static (their existing disabled mode), and drag is disabled via useSortable({ disabled: !canEdit }).
• Server-side authorization is unchanged — this is purely a UX/consistency affordance.

[56] No keyboard drag-reorder

An explicit onKeyDown on each card/row shadowed dnd-kit's KeyboardSensor activator (also spread via sortable.listeners.onKeyDown), so Space/Enter never started a keyboard drag.

• The KeyboardSensor is configured with keyboardCodes so Space picks up/drops and arrow keys move a card (Escape cancels), freeing Enter to open the task.
• The card/row onKeyDown now forwards to dnd-kit's activator (sortable.listeners?.onKeyDown) instead of shadowing it; Enter opens, and for non-draggable (read-only/nested) rows Space opens too.

Tests

• Added listTasksByProject canEdit cases (editor → true, read-only member → false) to convex/tasks/queries.test.ts.
• bunx vitest --run --project server convex/tasks → 100 passed.
• bunx tsc --noEmit → clean. bunx oxlint --type-aware app/features/tasks convex/tasks → 0 warnings/errors.

Closes #2069