fix(l1): resolve PR #193 frontend review findings (2a,2b,3,4,5,7)

Mounts L1EscalationsSection on EscalationQueuePage (Finding 2a — it was never
rendered) and renders the correct fields: step.question ?? step.text, timeAgo,
and the session problem_text (Finding 2b). ProposalDetail gates the /pilot link
on source_session_id and shows an L1-source block for l1_session_id-sourced
proposals (Finding 3 — was a broken /pilot/null link). Collapses the three
near-identical intake handlers into one runIntake: "Use this flow" now passes
near_miss.flow_id (Finding 4 — it previously re-suggested forever) and a
navigate guard prevents /l1/walk/undefined; out_of_scope gains a "Walk it
ad-hoc" button (Finding 5). Aligns L1-category permissions to owner+admin:
usePermissions.canManageAccount includes account admins, User.account_role TS
type gains 'admin', and a new ProtectedRoute requireAccountManager guard fronts
the route (Finding 7). Drops the unused NextNodeRequest.acknowledged field.

tsc -b + eslint + vite build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/components/flowpilot/ProposalDetail.tsx

@@ -88,18 +88,35 @@ export function ProposalDetail({ proposal, onReview }: ProposalDetailProps) {
 
       {/* Content */}
       <div className="flex-1 overflow-y-auto p-6 space-y-5">
-        {/* Source session link */}
-        <div className="card-flat p-4">
-          <h4 className="font-sans text-xs text-[0.625rem] uppercase tracking-wider text-text-muted mb-2">Source Session</h4>
-          <Link
-            to={`/pilot/${proposal.source_session_id}`}
-            target="_blank"
-            className="flex items-center gap-2 text-sm text-primary hover:underline"
-          >
-            <ExternalLink size={12} />
-            View session that generated this proposal
-          </Link>
-        </div>
+        {/* Source — exactly one of a FlowPilot session XOR an L1 walk is set
+            (DB CHECK). Never link to /pilot for an L1-sourced proposal:
+            source_session_id is NULL there, so the old unconditional link
+            rendered a broken /pilot/null. */}
+        {proposal.source_session_id ? (
+          <div className="card-flat p-4">
+            <h4 className="font-sans text-xs text-[0.625rem] uppercase tracking-wider text-text-muted mb-2">Source Session</h4>
+            <Link
+              to={`/pilot/${proposal.source_session_id}`}
+              target="_blank"
+              className="flex items-center gap-2 text-sm text-primary hover:underline"
+            >
+              <ExternalLink size={12} />
+              View session that generated this proposal
+            </Link>
+          </div>
+        ) : proposal.l1_session_id ? (
+          <div className="card-flat p-4">
+            <h4 className="font-sans text-xs text-[0.625rem] uppercase tracking-wider text-text-muted mb-2">Source — L1 AI walkthrough</h4>
+            <p className="text-sm text-muted-foreground">
+              Captured from an L1 technician's AI-guided walk and validated by a
+              successful resolution. The proposed flow is the path that resolved the ticket.
+            </p>
+            <p className="mt-2 flex items-center gap-1.5 text-xs text-text-muted">
+              <Hash size={11} />
+              <span className="font-mono">L1 session {proposal.l1_session_id.slice(0, 8)}</span>
+            </p>
+          </div>
+        ) : null}
 
         {/* Proposed diff (for enhancements) */}
         {proposal.proposed_diff && (() => {