Workbench: Billing tile is ungated — decide the right permission level before wider rollout

[man4ish]

Context

The Billing tile added to the Workbench launcher (src/ui/pages/Workbench.jsx, routing to src/ui/pages/Billing.jsx / App.jsx step 12) currently ships ungated — any signed-in user sees it.

This is deliberate for now (testing the read-only Billing page against live billing-service), but unlike the neighbouring cross-origin admin tiles:

• Admin Console, Control Center, Neo4j Browser → all gated on requiresPermission: ADMIN_CONSOLE_PERMISSION (platform.manage_infra).

The Billing tile has no requiresPermission at all. A TODO comment now sits next to the tile definition pointing here.

What needs deciding

Do not just copy the platform.manage_infra gate by default. Billing data shown by the page is read-only and arguably useful to regular org members:

• current plan / status / renewal dates
• plan feature flags
• usage vs. plan limits (usage/limits/costs)
• current billing-period cost + outstanding total

So the question is the right permission level:

• Option A — org membership itself (a valid orgId on the session is already required by Billing.jsx; the tile could simply be shown to anyone whose token carries an org_id).
• Option B — a dedicated billing.view / org.billing.read permission, if finer control is wanted.
• Option C — platform.manage_infra, matching the other admin tiles (most conservative, probably too restrictive).

The page component (Billing.jsx) already handles the unauthenticated and no-org states gracefully; this issue is specifically about the launcher tile visibility + any route-level guard.

Acceptance

• Decide permission level (A/B/C above)
• Add requiresPermission (or equivalent) to the Billing tile in Workbench.jsx
• Add matching guard on the Billing page/route in App.jsx if the chosen level is stricter than "has orgId"
• Remove the TODO comment next to the tile

Refs

• Tile + TODO: src/ui/pages/Workbench.jsx (Billing tile in buildCategories)
• Page: src/ui/pages/Billing.jsx, src/ui/lib/billingApi.js
• Backend gate that already protects the data: nginx-router.conf location ^~ /billing (auth_request)