Let a guest actually use search: declare the shipped guest grants, and draw the box for whoever can search

frontend/src/views/AppLayout.vue

@@ -11,9 +11,12 @@
         </div>
       </div>
 
-      <!-- Global search is authenticated; offering the box to a signed-out
-           reader gives them a control that can only answer 401. -->
-      <div v-if="authStore.isAuthenticated" class="sidebar-search">
+      <!-- Drawn only for a caller who can actually search. The server
+           answers that, because a guest has no user object here and
+           hasPermission would say no for the very visitor the guest grant
+           exists to serve. Members who lack assets.view lose a box that only
+           ever answered 401 to them. -->
+      <div v-if="cansearch" class="sidebar-search">
         <input
           v-model="searchQuery"
           type="text"
@@ -145,6 +148,10 @@ const routeViewKey = computed(() =>
   route.path.startsWith('/settings') ? '/settings' : route.path
 )
 const searchQuery = ref('')
+// Starts false so the box is never drawn before the server has said the
+// caller can use it. A flash of a control that then vanishes reads worse than
+// one that arrives a moment late.
+const cansearch = ref(false)
 const navItems = ref([])
 const activeNotifications = ref([])
 const facilityName = ref('ShopDB')
@@ -289,6 +296,15 @@ onMounted(async () => {
     navItems.value = buildNavItems(defaultNav)
   }
 
+  try {
+    const caps = await dashboardApi.capabilities()
+    cansearch.value = !!caps.data.data?.cansearch
+  } catch (err) {
+    // Leave the box hidden. Guessing from isAuthenticated here would put it
+    // back in front of members who cannot search, which is the thing this
+    // replaced.
+  }
+
   try {
     const resp = await notificationsApi.active()
     activeNotifications.value = resp.data.data?.notifications || []