SEP-1844: Gate the snippet execute form on the capability, not the query flag

Address review feedback.

The snippet accordion withheld its execute form from a read-only session
by disabling the schema query, but a disabled query still serves a cached
entry. The schema is held with `staleTime: Infinity` under a key carrying
no identity, and the shell never clears the query cache, so an admin's
fetch would render the form for a non-admin opening the same snippet
later in the same tab. The render now gates on `canMutate` as well; the
query flag stays as the request optimization. Covered by a test that
populates the cache as an admin and re-renders read-only, which fails
without the render gate.

Also restores two e2e session fixtures to non-admin. The snippet-download
spec exercises a GET that stays permitted, and the sidebar-navigation
specs only navigate and assert readable sentinels, so leaving both
non-admin keeps end-to-end coverage of the read-only experience this
change creates rather than broadening privileges the specs never use.

Author: nachodd

frontend/packages/e2e/tests/sidebar-navigation.spec.ts

@@ -59,9 +59,10 @@ const MOCK_USER = {
   email: 'smoke@percona.com',
   firstName: 'Smoke',
   lastName: 'Test',
-  // Admin: the app pages under test render their create / execute / delete
-  // controls only for a session that may mutate (SEP-1844).
-  isAdmin: true,
+  // Deliberately non-admin: these specs only navigate and assert readable
+  // sentinels, so they double as cross-app smoke coverage of the read-only
+  // experience (SEP-1844).
+  isAdmin: false,
 };
 
 // Heading served for schema-driven apps whose display name we don't assert

frontend/packages/e2e/tests/snippets-download.spec.ts

@@ -34,9 +34,10 @@ const MOCK_USER = {
   email: 'smoke@percona.com',
   firstName: 'Smoke',
   lastName: 'Test',
-  // Admin: the app pages under test render their create / execute / delete
-  // controls only for a session that may mutate (SEP-1844).
-  isAdmin: true,
+  // Deliberately non-admin: snippet download is a GET, still permitted for a
+  // read-only session, so this keeps end-to-end proof that the read path works
+  // for exactly the users whose write controls are hidden (SEP-1844).
+  isAdmin: false,
 };
 
 const MOCK_SNIPPET_SCHEMA = {

frontend/packages/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.test.tsx

@@ -528,6 +528,35 @@ describe('SnippetExecutionAccordion — write access', () => {
     expect(screen.queryByTestId('snippet-execute-read-only')).not.toBeInTheDocument();
   });
 
+  it('renders no execute form for a non-admin even when the schema is already cached', async () => {
+    // A disabled query still serves a cached entry, and this schema is held with
+    // `staleTime: Infinity` under a key that carries no identity — so an admin's
+    // fetch must not render the form for a non-admin in the same tab.
+    mockedApi.get.mockResolvedValue({ data: makeSchema() });
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false, staleTime: Infinity } },
+    });
+    const ui = (
+      <SnippetExecutionAccordion snippetFilename="check.sh" executorHost="db1" defaultExpanded />
+    );
+
+    // Admin populates the cache.
+    const { unmount } = render(
+      <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>,
+    );
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Execute' })).toBeInTheDocument();
+    });
+    unmount();
+
+    // Same QueryClient, now a read-only session.
+    mockCanMutate = false;
+    render(<QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>);
+
+    expect(screen.getByTestId('snippet-execute-read-only')).toBeInTheDocument();
+    expect(screen.queryByRole('button', { name: 'Execute' })).not.toBeInTheDocument();
+  });
+
   it('renders no execute form for a non-admin and fetches no schema', async () => {
     mockCanMutate = false;
     mockedApi.get.mockResolvedValue({ data: makeSchema() });

frontend/packages/framework/src/components/SnippetExecutionAccordion/SnippetExecutionAccordion.tsx

@@ -140,7 +140,12 @@ export function SnippetExecutionAccordion({
   const [logsEntry, setLogsEntry] = useState<TaskHistoryEntry | null>(null);
 
   // The form is the execute control, so a read-only session never renders it —
-  // and never needs its schema. History and logs stay readable.
+  // and never needs its schema. Disabling the query is only the request
+  // optimization: react-query still serves a cached entry, and this schema is
+  // held with `staleTime: Infinity` under a key that carries no identity, so an
+  // admin's fetch would otherwise render the form for a non-admin reaching the
+  // same snippet later in the same tab. The render gates on `canMutate` too.
+  // History and logs stay readable.
   const schemaQuery = useSnippetAccordionSchema(snippetFilename, expanded && canMutate);
   const executionMutation = useSnippetAccordionExecution(snippetFilename);
   const historyQuery = useSnippetAccordionHistory(snippetFilename, showHistory);
@@ -225,7 +230,7 @@ export function SnippetExecutionAccordion({
           </Alert>
         )}
 
-        {schemaQuery.data && (
+        {canMutate && schemaQuery.data && (
           <SchemaFormRenderer
             sections={filteredSections}
             onSubmit={handleSubmit}