fix(l1): resolve PR #193 frontend review findings (2a,2b,3,4,5,7)

Mounts L1EscalationsSection on EscalationQueuePage (Finding 2a — it was never
rendered) and renders the correct fields: step.question ?? step.text, timeAgo,
and the session problem_text (Finding 2b). ProposalDetail gates the /pilot link
on source_session_id and shows an L1-source block for l1_session_id-sourced
proposals (Finding 3 — was a broken /pilot/null link). Collapses the three
near-identical intake handlers into one runIntake: "Use this flow" now passes
near_miss.flow_id (Finding 4 — it previously re-suggested forever) and a
navigate guard prevents /l1/walk/undefined; out_of_scope gains a "Walk it
ad-hoc" button (Finding 5). Aligns L1-category permissions to owner+admin:
usePermissions.canManageAccount includes account admins, User.account_role TS
type gains 'admin', and a new ProtectedRoute requireAccountManager guard fronts
the route (Finding 7). Drops the unused NextNodeRequest.acknowledged field.

tsc -b + eslint + vite build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/components/layout/ProtectedRoute.tsx

@@ -5,13 +5,18 @@ import { Spinner } from '@/components/common/Spinner'
 
 interface ProtectedRouteProps {
   requiredRole?: EffectiveRole
+  // Gate on account-management capability (owner OR account-admin OR super_admin),
+  // mirroring backend require_account_owner_or_admin. Use instead of
+  // requiredRole="owner" when account admins must also pass — the role hierarchy
+  // has no 'admin' rung, so requiredRole alone wrongly bounces admins.
+  requireAccountManager?: boolean
   children: React.ReactNode
 }
 
-export function ProtectedRoute({ requiredRole, children }: ProtectedRouteProps) {
+export function ProtectedRoute({ requiredRole, requireAccountManager, children }: ProtectedRouteProps) {
   const { isAuthenticated, isLoading, user } = useAuthStore()
   const location = useLocation()
-  const { effectiveRole } = usePermissions()
+  const { effectiveRole, canManageAccount } = usePermissions()
 
   if (isLoading) {
     return (
@@ -48,6 +53,10 @@ export function ProtectedRoute({ requiredRole, children }: ProtectedRouteProps)
     }
   }
 
+  if (requireAccountManager && !canManageAccount) {
+    return <Navigate to="/trees" replace />
+  }
+
   if (requiredRole) {
     const ROLE_HIERARCHY: Record<EffectiveRole, number> = {
       super_admin: 5,