* fix: hide Delete Account button when ALLOW_ACCOUNT_DELETION is false
* fix: add admin bypass, inline env read, and tests for allowAccountDeletion
- Show delete button for admin users even when ALLOW_ACCOUNT_DELETION=false,
matching the canDeleteAccount middleware's ACCESS_ADMIN bypass
- Move env var read inline in buildSharedPayload() for per-request evaluation
- Add 4 frontend tests for Account conditional rendering
- Add 3 backend tests for allowAccountDeletion config field
* fix: use server-side ACCESS_ADMIN capability check instead of frontend role check
- Replace frontend SystemRoles.ADMIN check with server-side hasCapability()
in the authenticated config route, matching canDeleteAccount middleware exactly
- Admin bypass now evaluates ACCESS_ADMIN capability per-user in GET /api/config,
so users with the grant (regardless of role) see the button, and admins
without the grant do not
- Add 3 authenticated backend tests: without capability, with capability,
and skip-when-already-enabled
- Simplify frontend to pure config check (no role logic)
- Remove redundant jest-dom import; add inline env var comment
* test: add missing toHaveBeenCalled assertion in ACCESS_ADMIN test
d350c58633