Add Super Viewer read-only administrator role

src/routes/+layout.svelte

@@ -15,7 +15,7 @@
     import { resolveConfirmation } from '$ui/confirm.js';
     import '$ui/styles/components.css';
     import { enableViewTransitions } from '$ui/motion/viewTransition.js';
-    import type { AuthUser } from '$lib/auth.js';
+    import { canReadAdmin, type AuthUser } from '$lib/auth.js';
     // Side-effect import — puts @fontsource CSS on Vite's module graph so
     // the referenced woff/woff2 files get emitted into the build.
     import '$ui/styles/fonts.js';
@@ -172,7 +172,6 @@
                     armTimer = null;
                 }
                 const dest = shortcuts[e.key];
-                if ((e.key === 'h' || e.key === 'k') && data.user?.role !== 'admin') return;
                 if (dest) {
                     e.preventDefault();
                     goto(dest);
@@ -299,8 +298,11 @@
                                         >Keyboard shortcuts <span aria-hidden="true">?</span
                                         ></button
                                     >{/if}
-                                {#if data.user.role === 'admin' && sessionReady}<a
-                                        href="/settings/users">Manage users</a
+                                {#if canReadAdmin(data.user.role) && sessionReady}<a
+                                        href="/settings/users"
+                                        >{data.user.role === 'admin'
+                                            ? 'Manage users'
+                                            : 'View users'}</a
                                     >{/if}
                                 <button disabled={signingOut} onclick={signOut}
                                     >{signingOut ? 'Signing out…' : 'Sign out'}</button
@@ -319,6 +321,13 @@
                     >You can read fleet status and summaries. Operating servers or viewing raw
                     configs, file changes, logs, and telemetry requires an operator account.</span
                 >
+            </aside>{:else if sessionReady && data.user?.role === 'super_viewer'}<aside
+                class="viewer-note"
+            >
+                <strong>Super Viewer access</strong><span
+                    >You can view all administration pages, configs, logs, and diagnostics. Changes
+                    and server operations are unavailable.</span
+                >
             </aside>{/if}
         {@render children()}
     </main>