Show only what staff may use

export async function loadPermissions() {
  const [me, nav] = await Promise.all([staff.auth.me(), staff.navigation.retrieve()]);
  const can = (right: string) => me.rights?.includes(right) ?? false;
  return {
    can,                       // can("accounts.balance") → show the Deposit button
    scope: me.group_scope,     // groups this staff member sees
    modules: nav.nodes,        // the navigator tree, already filtered by rights
  };
}

Hide what the user cannot use, but still handle forbidden (403) everywhere: the server checks every call. When rights or scope change, the socket closes with reason "access changed": reconnect and load permissions again.