Project settings shows owner-only controls to non-owners

Project settings renders Labels and Statuses editing forms for all members, but the API only allows owners to mutate labels/statuses.

Affected areas:

• apps/web/src/routes/projects/[key]/settings/+page.svelte
• apps/api/src/routes/labels.ts
• apps/api/src/routes/statuses.ts

Impact:

• Non-owner members can interact with controls that fail with 403.
• UI implies permissions that the API does not grant.

Expected:

• Non-owners see read-only project settings or owner-only sections are hidden/disabled with a clear state.

Acceptance criteria:

• Gate Labels/Statuses editing by isOwner.
• Preserve useful read-only project information for members.
• Add component/load tests if an existing pattern fits.