Enforce role-based access control for Update Project Config

[hackerwins]

Description:

With the introduction of Members in the Dashboard, project roles now include Owner, Admin, and Member. The Update Project Config feature should follow the role-based permission model.

Currently, members can update project settings. This issue aims to restrict that behavior so that Members have read-only access, while Owners and Admins can modify settings.

Both Dashboard UI and Admin API changes are required to enforce this consistently.

Action	Owner	Admin	Member
Delete project	✅	❌	❌
Update project config	✅	✅	❌
Invite members	✅	✅	❌
Remove members	✅	✅	❌
Change roles	✅	✅	❌
Read / write documents	✅	✅	✅

Tasks

• UI (Dashboard)
  • Disable Project Config editing for Member role
  • Show config in read-only mode
• API (Admin)
  • Restrict Update Project Config API to Owner and Admin
  • Return proper authorization error for Member requests

Related to yorkie-team/yorkie#969

Why:

[lemon0333]

I'd like to work on this. My plan enforces the permission matrix in both places:

Dashboard UI — resolve the current user's project role from the members slice (selectCurrentMemberRole) and render the Project Config form read-only for the member role: the settings form is wrapped in a disabled fieldset, onSubmit is guarded, and a notice explains the restriction. Owners/Admins are unaffected.

Admin API — restrict UpdateProject to Owner/Admin so a Member receives a PermissionDenied error, mirroring the existing role checks (authz.CheckPermission(..., database.Admin)) already used by member-management handlers.

Note: while investigating I found the server-side check was already added to projects.UpdateProject in yorkie-team/yorkie#1628, so the API is in fact already enforced — but there was no test covering it for UpdateProject. My server PR therefore adds the missing RBAC integration test (Member denied, Admin/Owner allowed) rather than duplicating the check. The UI PR is the substantive change here and stands alone.

I'll open two PRs (dashboard UI + yorkie server test) and cross-link them.