feat: board-level author-only reply policy

[shamblashini]

Why

Communities/teams running public report or support boards want threads readable by everyone (for transparency) but writable only by the reporter and staff.

What

A board's access block gains an optional replyPolicy key ('anyone' | 'author-only'; absent = 'anyone', so no migration). On an author-only board only each post's own author and team members can comment, while everyone the view tier admits still reads every thread — each thread stays a publicly readable conversation between its author and the team.

Backward compatibility: the key is optional and absent on every existing board. Absent reads as 'anyone', the stored column default is byte-unchanged (still pinned to its original migration by the existing schema test), and normalization never injects the key so no migration is needed and existing boards behave exactly as before. This is covered by an explicit test ("an absent replyPolicy key behaves as 'anyone' (today's boards are unchanged)") plus schema tests asserting the key is never injected into legacy rows.

settings UI screenshot

the view of a locked-out user

How

Enforced centrally in canCreateComment (covers portal, widget, REST v1, and MCP), surfaced per-post to the portal and widget composers via a new canCommentOnPost capability, and configured from the board's Access settings tab. Portal/widget show an explanatory notice in place of the composer; strings added to all nine locale catalogs.

Testing

• New unit/component tests: policy (author / non-author / team / anonymous, tier + lock interactions, absent-key backward compat), zod schema accept/reject, admin form round-trip preserving all other access keys.
• bun run test fully green; the Playwright suites touching these surfaces (admin boards, public portal, widget) pass locally. I didn't add a new browser E2E spec since the closest existing features (comment locks, moderation rules) are tested at the policy/component level too (can add one if needed).

How to test

Create a board, enable "Only the post author and team members can reply" (Admin > Settings > Feedback & Roadmaps > Boards > Access), then:

1. create a post in the board as a regular user
2. try commenting on it as a different user (denied - the composer is replaced by a notice; the author can still reply)
3. try commenting as an admin/team member (works as normal)

[CLAassistant]

All committers have signed the CLA.

[shamblashini]

I see that the branch now has conflicts with main, I will resolve them if needed.