Privileged navigation must mirror membership-source authority

Observed 2026-09-04 in e3-solutions/theft, COR-3971 / PR #796.

A client-side role check was insufficient for Dashboard settings because synthetic super-admin memberships can project role=admin while the API intentionally requires a persisted organization admin. Privileged navigation should mirror the complete server authority contract, including membership source, not only the display role.

For frequently polled queue indicators, expose a count-only query that reuses the queue’s canonical visibility predicate. Reusing the full paginated query preserves semantics but unnecessarily adds materialization, ordering, and pagination work every poll.