fix(auth): split Book Dock access from Book Dock administration

Book Dock was a single permission that the standard preset handed to every user, so an ordinary
account could pause processing, trigger a rescan, and finalize straight into the library. Keep
book_dock_access for personal upload and review, and move global control behind a new
manage_book_dock permission in the administration group.

Finalization now also requires library_upload, since it writes into a library. Per-file reads and
mutations are scoped to the uploader unless the caller can manage the dock, which closes the gap
that let any Book Dock user read, edit, or discard another user's entry by id. The summary
websocket now announces a change instead of broadcasting global counts, so each client refetches
its own scoped totals.

Closes #961

server/test/e2e/authorization-matrix/route-inventory/manifest.json

@@ -5,7 +5,7 @@
     "Permission.ManageMetadataConfig": 32,
     "Permission.EmailSend": 30,
     "Permission.LibraryEditMetadata": 33,
-    "Permission.BookDockAccess": 17,
+    "Permission.BookDockAccess": 16,
     "Permission.ManageAppSettings": 22,
     "Permission.ManageLibraries": 14,
     "Permission.ManageUsers": 11,
@@ -19,7 +19,8 @@
     "Permission.ViewUserActivity": 6,
     "Permission.LibraryDeleteBooks": 1,
     "Permission.LibraryDownload": 1,
-    "Permission.LibraryUpload": 1,
+    "Permission.LibraryUpload": 2,
+    "Permission.ManageBookDock": 1,
     "Permission.ManageIcons": 1,
     "Permission.HardcoverSync": 1,
     "Permission.ReadwiseSync": 1,