feat: implement executor features for read users via config

[ruodeng]

Description

This PR refines the "Executor" role permissions by splitting the broad enableexecutorfeatures configuration into two granular flags. This provides administrators with finer control over what "Read-only" users can do within the system.

💡 Motivation

Previously, enableexecutorfeatures bundled several distinct permissions (commenting, editing assigned tasks, and creating tasks). This led to an "all-or-nothing" approach which was often too permissive.

This change allows decoupling these capabilities:

• Granular Control: Admins can now allow commenting without allowing task editing, or vice-versa.
• Security & Logic: It removes the implicit ability for "Read" users to create tasks, ensuring task creation is strictly reserved for users with Write permissions or higher, aligning with standard RBAC (Role-Based Access Control) expectations.

🛠 Changes

Backend:

• Config: Deprecated service.enableexecutorfeatures. Added service.enablereadercomments and service.enableassigneeedit.
• API: Updated /info endpoint to expose ReaderCommentsEnabled and AssigneeEditEnabled.
• Models/Permissions:
  • TaskComment.CanCreate: Now toggled by ServiceEnableReaderComments.
  • Task.CanUpdate: Now toggled by ServiceEnableAssigneeEdit.
  • Task.CanCreate: Removed the legacy logic that allowed "Read" users to create tasks.

Frontend:

• Store: Updated config store to support the new granular flags.
• Views:
  • TaskDetailView.vue: Updated canComment and canWrite logic to check the new flags and verify if the user is the assignee/creator.
  • UI Cleanup: Reverted broad "write" checks in ProjectList and ProjectKanban to hide creation UI elements (like "Add Task" buttons) from users with only Read access.

⚙️ Configuration

The following settings are now available in config.yml:

service:
  # Allows users with Read access to comment on tasks
  enablereadercomments: true 
  # Allows users with Read access to edit tasks IF they are the assignee or creator
  enableassigneeedit: true

[kolaente]

But there is no "Executor" role?