fix: harden permissions system after code review

- Gate permissions in /app-config behind optionalAuth so unauthenticated
  requests don't receive admin configuration
- Fix trip_delete isMember parameter (was hardcoded false)
- Return skipped keys from savePermissions for admin visibility
- Add disabled prop to CustomSelect, use in BudgetPanel currency picker
- Fix CollabChat reaction handler returning false instead of void
- Pass canUploadFiles as prop to NoteFormModal instead of internal store read
- Make edit-only NoteFormModal props optional (onDeleteFile, note, tripId)
- Add missing trailing newlines to .gitignore and it.ts

server/src/routes/admin.ts

@@ -177,7 +177,7 @@ router.put('/permissions', (req: Request, res: Response) => {
   if (!permissions || typeof permissions !== 'object') {
     return res.status(400).json({ error: 'permissions object required' });
   }
-  savePermissions(permissions);
+  const { skipped } = savePermissions(permissions);
   writeAudit({
     userId: authReq.user.id,
     action: 'admin.permissions_update',
@@ -185,7 +185,7 @@ router.put('/permissions', (req: Request, res: Response) => {
     ip: getClientIp(req),
     details: permissions,
   });
-  res.json({ success: true, permissions: getAllPermissions() });
+  res.json({ success: true, permissions: getAllPermissions(), ...(skipped.length ? { skipped } : {}) });
 });
 
 router.get('/audit-log', (req: Request, res: Response) => {