Members can request publish (POST /api/research/:id/publish) but only
Owners can decide it. Enforced server-side with an early role check in
decide_publish (before the DB lookup, so it can't leak resource
existence to non-owners), and mirrored in the UI: ResearchCanvas takes
a canApprovePublish prop derived from the current user, hides the
Approve/Reject controls for Members, and swaps the copy to point out
that an Owner needs to act.
Test coverage: crates/cm-api/tests/research_publish_role.rs — Members
get 403, Owners reach the DB and get 404 on a bogus approval id.
Frontend threading: fetchMe already returns the role; page.tsx now
forwards it to Dashboard, which forwards to ResearchCanvas.
