Let a guest actually use search: declare the shipped guest grants, and draw the box for whoever can search

docs/openapi.json

@@ -2447,6 +2447,34 @@
     }
    }
   },
+  "/api/dashboard/capabilities": {
+   "get": {
+    "tags": [
+     "core-platform"
+    ],
+    "summary": "Booleans describing what THIS caller may reach, so the app chrome can avoid drawing controls that would only answer...",
+    "description": "Booleans describing what THIS caller may reach, so the app chrome can avoid drawing controls that would only answer 401; cansearch reports whether the caller holds assets.view, which a signed-out visitor does when the guest role has been granted it\n\n**Auth:** none\n\n**Params:** none\n\n**Example:**\n```\ncurl http://localhost:5001/api/dashboard/capabilities\n```",
+    "security": [],
+    "responses": {
+     "200": {
+      "description": "Success. Body is the success_response envelope: {status, data, meta}.",
+      "content": {
+       "application/json": {
+        "$ref": "#/components/schemas/SuccessEnvelope"
+       }
+      }
+     },
+     "default": {
+      "description": "Error. Body is the error envelope; the code and message are nested under data.error.",
+      "content": {
+       "application/json": {
+        "$ref": "#/components/schemas/ErrorEnvelope"
+       }
+      }
+     }
+    }
+   }
+  },
   "/api/dashboard/widgets": {
    "get": {
     "tags": [