[wentz-s]

Summary

A viewer (read-only role) still had several live write controls. The API refuses all of them with 403 (checked on the dev sandbox for adding and deleting a host), so nothing was ever written, but the viewer got a button that looked usable and then an error. Everything a viewer cannot do is now disabled rather than hidden, with "Your account has read-only access" as its tooltip, like the controls that already were.

Hosts

• The hosts sidebar's + Add a host and each host's Delete are disabled for a viewer. Selecting a host still works.
• The "No hosts yet" screen's Add a host is disabled too, and the text under it tells a viewer to ask an editor to add one.
• Disabled buttons leave the tab order, so the keyboard does not reach them either.

Rules

• The "No rules yet" screen's New redirect and New rewrite were never tied to the role. They are disabled for a viewer now.
• A viewer can still open a rule to read it, but the editor now opens as View redirect / View rewrite: every field is locked, Save changes is disabled, and Cancel reads Close. Before, a viewer could edit the fields and only learn on save.
• For a viewer, the editor no longer asks the API to check the distribution for a country rule. The API counts that check as a write, so a viewer's was refused and the editor said the distribution could not be checked.

Linking

• The no-distribution screen a viewer reaches already showed them no form. It now reads No distribution linked yet: "Your account has read-only access, so it cannot link one. Ask an editor or an admin to set up a distribution."

Disabled buttons look disabled

• No style dimmed a disabled .btn, so a viewer's header Import / Rewrite / Redirect looked exactly like live buttons. Any disabled .btn is now dimmed with a not-allowed cursor, and its hover and press effects are off.
• This also dims buttons disabled for other reasons, such as a dialog's Cancel and Save while a save is running. The link screen's inline opacity for the same thing is removed.

Editors see no change apart from that dimming.

Known limit: the rule editor's locked fields are disabled inputs, so a viewer cannot select or copy their text, or scroll to the end of a value longer than its box.

Tests

Lint, typecheck, UI unit tests (586) and Playwright (189/189), all green. New or updated e2e specs, all run as a viewer:

• hosts.e2e.ts: + and Delete are disabled with the tooltip and a host still opens; Tab skips both; the empty state's button is disabled and says to ask an editor.
• rules.e2e.ts: the "No rules yet" buttons are disabled and dimmed; a rule opens read-only with nothing to save and no write sent; a country rule does not start the distribution check.
• link.e2e.ts: the no-distribution screen shows the new heading and text, and no form or Link button.

Each of these fails without the change.

Ticket

CF-59

Checklist

• CI is green (lint, typecheck, schemas)
• If the rule shape changed: shared/ schemas and their shared/examples/ were updated together (n/a)
• If the rule shape changed and the console API exists (step 2): its OpenAPI spec $refs the updated schemas — no inline redefinition (n/a)
• The module still takes no input about, and creates no, aws_cloudfront_distribution (except under examples/)