Backend permission enforcement (LMS) #485

Enforce the new permissions in the LMS endpoints used by each Instructor Dashboard tab. The shared infrastructure (#486) comes first; the per-tab subtasks can then be worked on in parallel.

Common acceptance criteria

• Every endpoint of the tab checks the right permission and returns 403 in the standard format (error_code: permission_denied).
• Tests cover a user with Course Admin, one with Course Staff and one without permission.
• Users with the equivalent legacy role and no AuthZ role keep their access.
• The tab's visibility in CourseMetadataView matches the tab's read permissions.