Allow role-based ownership/editing of profile tabs and widgets (not admin-only)

[cerb]

Summary

Profile tabs and profile widgets are currently editable only by administrators. There is no way to delegate "edit/add widgets on a profile tab" to a non-admin worker via roles. This request is to make profile tab/widget editing grantable through role privileges (and/or support role-scoped ownership of profile layouts).

Current behavior

Both record contexts gate all writes through _isWriteableOnlyByAdmin():

• features/cerberusweb.core/api/dao/profile_tab.php — Context_ProfileTab::isWriteableByActor() → _isWriteableOnlyByAdmin()
• features/cerberusweb.core/api/dao/profile_widget.php — Context_ProfileWidget::isWriteableByActor() → _isWriteableOnlyByAdmin()
• libs/devblocks/api/Extension.php — _isWriteableOnlyByAdmin() denies any non-admin actor regardless of role privileges.

Reading is open to all workers (isReadableByActor → allowEverything), so non-admins see customized profile tabs/widgets but cannot modify them.

Why

Profiles are a shared, system-wide layout per record type. Teams often want trusted non-admins (e.g. team leads) to curate the widgets shown on a ticket/org/contact profile tab without granting full administrator access (which also unlocks Setup and all global configuration). Today the only options are "make them an admin" or "they can't touch it."

Proposed behavior

Make profile tab/widget write access respect role privileges, for example:

• Add grantable privileges for create/update/delete on Profile Tab and Profile Widget record types that actually take effect (currently they are overridden by the admin-only check).
• Optionally, support role-scoped ownership so a role can be designated as the editor/owner of specific profile tabs or widgets.

Notes

For per-worker private, self-editable layouts there are already workspace dashboards; this request is specifically about the shared record-type profile tabs/widgets.