fix(recommendations): scoped users see 'Recommendations refresh failed: permission denied' after the stale-data auto-refresh became scope-gated #619

Found in the review of PR #615 (#520 slice: POST /api/recommendations/refresh now requires an unrestricted account scope because it runs a global collection and takes the single global in-flight marker). The frontend auto-refreshes stale data: triggerAutoRefreshIfStale (frontend/src/recommendations.ts ~317; callers loadRecommendations ~670 and dashboard.ts ~227) fires for any user with view:recommendations when the data is older than 24h. For a scoped user it now shows an info toast 'Refreshing recommendations…' then an error toast 'Recommendations refresh failed: permission denied: refreshing recommendations covers every account and requires unrestricted account access', on both the Home dashboard and Opportunities. The data still loads; the message is misleading (an automatic action the user never asked for is reported as failed, with no next step).

The frontend cannot tell scope today: User has only groups and effectivePermissions and /auth/me/permissions carries no scope field.

Acceptance: either add a scope field (or an 'unrestricted' flag) to the permissions/me response and skip the auto-refresh for scoped users, or handle a 403 on the AUTO path quietly (dismiss the in-flight toast, no error toast, console log) without hiding genuine 403s such as a missing view permission; with a recommendations.test.ts case (jest, tests around ~1622-1680 cover triggerAutoRefreshIfStale). Also decide whether scoped users should get a per-account refresh (needs a new CollectRecommendations contract: account filter plus a per-account marker). Related: #520, #615, #617.