Viewer role enforcement on write endpoints

[shreydevkar]

The share endpoint currently rejects role='viewer' because enforcement isn't wired. The infrastructure (_current_role ContextVar + _require_editor() helper) exists; it just needs plumbing into every mutation endpoint.

Acceptance criteria:

• Every write endpoint (/grid/cell, /grid/range, /grid/clear, /agent/apply, /agent/chat/chain, /workbook/sheet*, /system/save, chart/macro CRUD) calls _require_editor() at the top.
• Unit test via TestClient that a viewer caller gets 403 on each.
• Share modal adds a role picker (editor / viewer).
• Invite endpoint starts accepting role='viewer' again.