research/publish: gate approve+reject on workspace Owner role

Members can request publish (POST /api/research/:id/publish) but only
Owners can decide it. Enforced server-side with an early role check in
decide_publish (before the DB lookup, so it can't leak resource
existence to non-owners), and mirrored in the UI: ResearchCanvas takes
a canApprovePublish prop derived from the current user, hides the
Approve/Reject controls for Members, and swaps the copy to point out
that an Owner needs to act.

Test coverage: crates/cm-api/tests/research_publish_role.rs — Members
get 403, Owners reach the DB and get 404 on a bogus approval id.

Frontend threading: fetchMe already returns the role; page.tsx now
forwards it to Dashboard, which forwards to ResearchCanvas.

crates/cm-api/src/routes/research.rs

@@ -13,8 +13,8 @@
 //!   POST   /api/research/:id/submit-review              processing → reviewing
 //!   POST   /api/research/:id/request-publish            create pending publish approval
 //!   GET    /api/research/publish-approvals              list workspace's pending approvals
-//!   POST   /api/research/publish-approvals/:id/approve  reviewing → publishing
-//!   POST   /api/research/publish-approvals/:id/reject   stays in reviewing
+//!   POST   /api/research/publish-approvals/:id/approve  reviewing → publishing (Owner only)
+//!   POST   /api/research/publish-approvals/:id/reject   stays in reviewing    (Owner only)
 //!   POST   /api/research/wizard/refine                  one-shot LLM refine helper
 
 use axum::extract::{Path, State};
@@ -965,6 +965,12 @@ async fn decide_publish(
     approve: bool,
     notes: Option<String>,
 ) -> Result<StatusCode, ApiError> {
+    // Publish gate is workspace-owner-only. Members can request review (via
+    // POST /api/research/:id/publish) but cannot decide it — mirrors the
+    // billing/access-policy scope described in Role::is_owner (spec §1).
+    if !user.role.is_owner() {
+        return Err(ApiError::Forbidden);
+    }
     let approval =
         cm_db::repo::research_publish_approvals::get(&state.pool, id, user.workspace_id.as_uuid())
             .await?

crates/cm-api/tests/research_publish_role.rs

@@ -0,0 +1,128 @@
+//! Publish gate is Owner-only. The role check must fire before any DB
+//! work, so we probe it with a bogus approval id: Members see 403 (role
+//! guard), Owners see 404 (row missing) — proving ordering + coverage on
+//! both approve and reject.
+
+use std::sync::Arc;
+
+use cm_api::AppState;
+use cm_auth::AuthService;
+use cm_domain::{Role, User, UserId, Workspace, WorkspaceId};
+use cm_llm::ScriptedProvider;
+use cm_runtime::{Runtime, RuntimeConfig};
+use reqwest::StatusCode;
+use serde_json::{json, Value};
+use uuid::Uuid;
+
+struct Server {
+    base: String,
+    client: reqwest::Client,
+}
+
+async fn serve(pool: sqlx::PgPool) -> Server {
+    let runtime = Runtime::new(
+        pool.clone(),
+        Arc::new(ScriptedProvider::from_toml("").unwrap()),
+        RuntimeConfig::basic("scripted", 1024),
+    );
+    let app = cm_api::router(AppState::new(pool, runtime));
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    Server {
+        base: format!("http://{addr}"),
+        client: reqwest::Client::new(),
+    }
+}
+
+async fn seed_user(pool: &sqlx::PgPool, ws: WorkspaceId, role: Role, email: &str) -> UserId {
+    let user = User {
+        id: UserId::new(),
+        workspace_id: ws,
+        email: email.into(),
+        role,
+        display_name: format!("{role:?}"),
+        created_at: time::OffsetDateTime::UNIX_EPOCH,
+    };
+    cm_db::repo::users::insert(pool, &user).await.unwrap();
+    AuthService::new(pool.clone())
+        .set_password(user.id, "pw")
+        .await
+        .unwrap();
+    user.id
+}
+
+async fn login(server: &Server, email: &str) -> String {
+    server
+        .client
+        .post(format!("{}/api/auth/login", server.base))
+        .json(&json!({"email": email, "password": "pw"}))
+        .send()
+        .await
+        .unwrap()
+        .json::<Value>()
+        .await
+        .unwrap()["token"]
+        .as_str()
+        .unwrap()
+        .to_owned()
+}
+
+#[tokio::test]
+async fn publish_decide_is_owner_only() {
+    let pool = cm_testkit::test_pool().await;
+    let server = serve(pool.clone()).await;
+
+    let ws = Workspace {
+        id: WorkspaceId::new(),
+        name: "Acme".into(),
+        plan: "team".into(),
+    };
+    cm_db::repo::workspaces::insert(&pool, &ws).await.unwrap();
+
+    let owner_email = format!("owner-{}@acme.test", UserId::new());
+    let member_email = format!("member-{}@acme.test", UserId::new());
+    seed_user(&pool, ws.id, Role::Owner, &owner_email).await;
+    seed_user(&pool, ws.id, Role::Member, &member_email).await;
+
+    let owner_tok = login(&server, &owner_email).await;
+    let member_tok = login(&server, &member_email).await;
+
+    // Bogus id: role guard should fire before the DB lookup.
+    let bogus = Uuid::now_v7();
+
+    for path in [
+        format!("/api/research/publish-approvals/{bogus}/approve"),
+        format!("/api/research/publish-approvals/{bogus}/reject"),
+    ] {
+        let member_resp = server
+            .client
+            .post(format!("{}{path}", server.base))
+            .bearer_auth(&member_tok)
+            .json(&json!({}))
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(
+            member_resp.status(),
+            StatusCode::FORBIDDEN,
+            "member should be forbidden on {path}"
+        );
+
+        let owner_resp = server
+            .client
+            .post(format!("{}{path}", server.base))
+            .bearer_auth(&owner_tok)
+            .json(&json!({}))
+            .send()
+            .await
+            .unwrap();
+        assert_eq!(
+            owner_resp.status(),
+            StatusCode::NOT_FOUND,
+            "owner should reach DB lookup + get 404 on {path}"
+        );
+    }
+}