fix(settings): gate integration tabs by integration permissions

Prevent unauthorized users from seeing integrations they cannot use and keep settings routing consistent with API authorization behavior. Add hardcover_sync and enforce it server-side so tab visibility and endpoint access stay aligned.

server/test/authorization-matrix.e2e-spec.ts

@@ -421,6 +421,11 @@ describe('Authorization matrix (e2e)', () => {
           path: '/koreader/credentials',
           token: 'allPerms',
         },
+        [Permission.HardcoverSync]: {
+          method: 'GET',
+          path: '/hardcover/settings',
+          token: 'allPerms',
+        },
         [Permission.DemoRestricted]: {
           method: 'GET',
           path: '/notifications',