Block downloads for view-only accounts

[ahernsean]

Summary

• deny CSV and DMV export endpoints for view-only sessions
• hide CSV backup and DMV PDF download controls for view-only accounts
• cover direct-route denials and hidden controls

Validation

• PYTHONPATH=. .venv/bin/ruff check .
• PYTHONPATH=. .venv/bin/ruff format --check .
• PYTHONPATH=. .venv/bin/mypy
• PYTHONPATH=. .venv/bin/pytest -m "not browser" --cov --cov-report=term-missing --cov-fail-under=95
• DRIVING_LOG_WEBKIT_WS_ENDPOINT=ws://127.0.0.1:31747/ PYTHONPATH=. .venv/bin/pytest -m browser
• git diff --check