Add Super Viewer read-only administrator role

tests/unit/retention.test.ts

@@ -377,7 +377,7 @@ it('never removes the calibration window when choosing a shorter resource retent
         n: 0
     });
 });
-it('previews draft retention without saving it and restricts retention tools to administrators', async () => {
+it('previews draft retention without saving it and distinguishes admin reads from writes', async () => {
     const a = await api();
     a.db
         .prepare(
@@ -401,8 +401,9 @@ it('previews draft retention without saving it and restricts retention tools to
     expect(a.fleetSettings().deployKeepDays).toBe(0);
     expect(a.db.prepare('SELECT id FROM deployments').get()).toEqual({ id: 'preview' });
     const { routePermission } = await import('../../src/lib/server/auth/access.js');
-    expect(routePermission('/api/settings/retention', 'GET')).toBe('admin');
-    expect(routePermission('/api/settings/retention/preview', 'POST')).toBe('admin');
+    expect(routePermission('/api/settings/retention', 'GET')).toBe('admin-read');
+    expect(routePermission('/api/settings/retention', 'POST')).toBe('admin');
+    expect(routePermission('/api/settings/retention/preview', 'POST')).toBe('admin-read');
 });
 it('protects cancelled workflows and linked file history through ambiguous and unreconciled receipts', async () => {
     const a = await api();