fix(settings-page, team-page): refactor permission checks to use project-specific hooks

[pikann]

Summary

Fixes #468 — drag-and-drop reordering of task statuses could silently appear disabled (no grab cursor, no handle) for users who actually had tasks.write, and only a hard page reload fixed it.

Root cause: the Settings and Team pages each hand-rolled their own permission check by fetching the entire project members list and entire roles list, then manually cross-referencing them client-side to find "my role" and read its permission map. That derived state had no reliable invalidation path, so it could go stale in an open tab until a full reload forced everything to refetch.

Fix: both pages now use useProjectPermissions(projectId) — the dedicated hook (backed by GET /projects/:id/members/me/permissions) already used consistently across ~20 other pages (backlog, sprints, docs, task detail, etc.) — instead of reimplementing permission derivation from bulk members/roles data.

Changes

• settings/index.tsx: canDelete, canEditProject, canManageRoles, and canManageTasks (which gates the task-status drag handle) now read from hasProjectPermission(...) instead of manually resolving members → myMembership → myRole → permissions. Removed the now-unused currentUserQueryOptions/members/roles derivation.
• team/index.tsx: canManageMembers follows the same pattern; removed the now-unused currentUserQueryOptions fetch.

Both pages still fetch members/roles where that data is actually rendered (member list, role dropdowns) — only the permission-derivation logic changed.

Testing

• tsc -b passes
• biome check passes
• No existing test coverage for these two route files

Note: this fixes the architectural inconsistency and removes staleness on normal remount/refocus/navigation, but doesn't add a live push — if a role's permissions change while an affected user's tab stays open and focused with no navigation, they'd still need some trigger (refocus/nav/reload) to see it, since the backend doesn't yet publish a change event for role/member updates.

🤖 Generated with Claude Code

[pullfrog]

• Checkout PR fix(settings-page, team-page): refactor permission checks to use project-specific hooks #481 and read full diff
• Read PR summary snapshot and learnings
• Triage: understand the changed code and its context
• Dispatch specialists if needed
• Aggregate findings and draft review
• Submit review + update summary snapshot

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}