feat: add DevTools plugin gated to cloud-engineering/admins

[quiiver]

What

Adds the Backstage DevTools plugin (frontend page + backend) and restricts it
to members of the cloud-engineering/admins workgroup subgroup via a custom
permission policy.

• Backend: @backstage/plugin-devtools-backend; a custom PermissionPolicy
  (permissionPolicyDevToolsAdmin) replacing the allow-all policy — returns ALLOW
  for everything except DevTools permissions, which require
  group:workgroups/cloud-engineering-admins in the caller's ownershipEntityRefs.
  Gates the stable devToolsPermissions aggregate plus the alpha
  Scheduled-Tasks permissions.
• Frontend: @backstage/plugin-devtools (new frontend system) added to the
  features array; a RequirePermission-gated sidebar entry (hidden for non-admins).
• Config: devTools.scheduledTasks.plugins: [catalog] to surface the catalog
  plugin's scheduled tasks.

Depends on

Account-linking (#129, merged) — that work is what makes a signed-in
cloud-engineering/admins member's ownershipEntityRefs actually contain the
group, so the gate can pass. Without it the gate is inert.

Notes

• The Scheduled-Tasks tab's read/trigger/cancel hit the catalog plugin's core
  .backstage/scheduler/v1/tasks API, which isn't permission-integrated in the
  pinned versions — the gate there is frontend/defense-in-depth, not a hard lock.
• Suggest squash-merge (history contains an intermediate wip: commit).

Verification

Backend policy unit tests (14) green; tsc, lint, prettier clean. Merged current
main (incl. account-linking) into the branch.