feat: show access denied UI for canvas components when metrics view is inaccessible

[ericokuma]

Summary

When a user doesn't have access to metrics views referenced by canvas components (due to security policies), the backend silently removes those metrics views from the referencedMetricsViews response. Previously, this caused all affected components to show alarming red "Metrics view X not found" error messages, which was confusing and looked broken.

This PR introduces a cleaner, muted "access denied" UI that correctly differentiates between true configuration errors and access restrictions.

Changes

CanvasEntity (canvas-entity.ts)

• Added _accessDeniedMetricsViews store to track metrics views that are referenced by components but not present in the referencedMetricsViews response (indicating the backend filtered them due to access policies)
• Added isMetricsViewAccessDenied(name) method returning a reactive boolean store
• Added computeAccessDeniedMetricsViews() to compute the denied set during spec processing

ComponentAccessDenied.svelte (new)

• A muted, non-alarming component showing a lock icon and "You don't have access to this component" message
• Uses neutral bg-surface-secondary/50 background instead of destructive red

Canvas display components updated:

• CanvasChart.svelte - shows access denied UI for both schema and data errors
• LeaderboardDisplay.svelte - shows access denied UI when schema validation fails
• CanvasPivotDisplay.svelte + CanvasPivotRenderer.svelte - passes access denied state to renderer
• KPIGrid.svelte - imported ComponentAccessDenied (KPI items handled by provider)
• KPIProvider.svelte - shows access denied UI instead of rendering disabled KPI

CanvasComponent.svelte

• Added neutral border style for access-denied cards (vs destructive red for true errors)

How it works

The backend's ResolveCanvas API applies security policies and removes inaccessible metrics views from referencedMetricsViews, but still returns all components in the canvas spec. By comparing component metrics_view references against the available referencedMetricsViews, we can determine which views were filtered due to access restrictions and show an appropriate UI.

Closes APP-790

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
• Intend to cherry-pick into the release branch
• I'm proud of this work!

Linear Issue: APP-790