fix: remove canWrite from IAM — it is IAM RBAC, not our app logic

- IAM permissions.can_write defaults to false for all users
- Our app controls writes via adminMode + company membership

src/auth.js

@@ -313,7 +313,6 @@ async function fetchIamUser(token) {
   const activeProfile = profiles.find(p => p.is_active_profile) || profiles[0] || {};
   const ui = raw.userInfo || {};
   const imp = raw.impersonation || {};
-  const perms = raw.permissions || {};
 
   return {
     email:          ui.email || '',
@@ -323,7 +322,6 @@ async function fetchIamUser(token) {
     companyId:      ui.companyId || '',
     companyName:    ui.company || activeProfile.company_name || '',
     isAdmin:        !!ui.isAdmin,
-    canWrite:       perms.can_write !== false,
     isImpersonated: !!(imp.is_impersonated),
     impersonationType:     imp.type || null,
     originalUserEmail:     imp.originalUserEmail || '',

src/routes/oidc.js

@@ -73,7 +73,6 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
           companyId:      iamData.companyId,
           companyName:    iamData.companyName,
           isAdmin:        iamData.isAdmin,
-          canWrite:       iamData.canWrite,
           isImpersonated: iamData.isImpersonated,
           impersonationType:     iamData.impersonationType,
           originalUserEmail:     iamData.originalUserEmail,