feat(activities): let creators lock edit and delete to themselves

Add editPolicy (default creator-only), enforce it in the API, surface clear permission messages, and drop the redundant edit menu now that detail is editable.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/lib/activity-access.ts

@@ -0,0 +1,23 @@
+import type { ActivityDto, ActivityEditPolicy } from '@mento/shared';
+
+type ActivityAccessUser = {
+  id?: string | null;
+  role?: string | null;
+} | null | undefined;
+
+/** ویرایش/حذف فیلدهای فعالیت — انجام/جابه‌جایی ستون جداست */
+export function canMutateActivity(
+  activity: Pick<
+    ActivityDto,
+    'editPolicy' | 'createdBy' | 'assignee' | 'assignees'
+  > | null | undefined,
+  user: ActivityAccessUser,
+): boolean {
+  if (!activity || !user?.id) return false;
+  if (user.role === 'owner' || user.role === 'admin') return true;
+  if (activity.createdBy?.id === user.id) return true;
+  const policy: ActivityEditPolicy = activity.editPolicy ?? 'creator';
+  if (policy !== 'assignees') return false;
+  if (activity.assignee?.id === user.id) return true;
+  return (activity.assignees ?? []).some((a) => a.id === user.id);
+}