fix(#350): list collaborator permissions

[DSanich]

Summary

• Added a centralized list-permission resolver to unify owner/collaborator/read-only capability checks.
• Enforced permission checks in list mutations (add, remove, delete) so access control is applied beyond UI visibility.
• Updated list detail and add-to-list flows to pass owner context and align action availability/error handling with mutation-level authorization.
• Added unit tests for the permission matrix (owner, collaborator, outsider).

Avoid naming corporate partners, customers, or other sensitive external brands in this PR title or body. Use generic descriptors unless a maintainer explicitly approves the public reference.

Motivation

• List collaboration metadata existed, but edit permissions were not consistently enforced across UI and mutation paths.
• This created potential mismatch between what users could see and what operations were actually allowed.
• The change centralizes permission logic and makes behavior predictable and safe end-to-end.

Related Issue

• Closes fix(lists): enforce collaborator permissions end-to-end #350

Testing

• npm run test
• Manual verification completed

Additional validation performed during implementation:

• npx vitest run src/lib/listPermissions.test.ts
• npx tsc -p tsconfig.app.json --noEmit
• npx eslint src/lib/listPermissions.ts src/lib/listPermissions.test.ts src/hooks/useVideoLists.ts src/components/AddToListDialog.tsx src/pages/ListDetailPage.tsx

Visuals

• UI change with screenshots/video attached
• No visual change
• Visuals and text avoid sensitive external brand or partner names unless explicitly approved

[github-actions]

🚀 Preview Deployment

Property	Value
Preview URL	https://dfcc7875.divine-web-fm8.pages.dev
Commit	dbe296c
Branch	fix/350-list-collaborator-permissions