nav items declare their permission

CHANGELOG.md

@@ -115,6 +115,15 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **The sidebar offered pages the reader could not open, and hid ones they
+  could.** A nav item is hidden from anybody who does not hold its permission,
+  but only four items ever declared one - so the filter did nothing for the
+  rest, and a signed-out visitor granted `machines.view` still saw an empty
+  sidebar. Every item now names the read permission its page needs, in the
+  plugins, in the core navigation endpoint and in the frontend's fallback list.
+  A signed-in member with a sparse role will notice the same correction: a link
+  that could only answer 403 no longer appears.
+
 - **Every report offers to email itself, not just two of them.** `POST
   /api/reports/email` has always taken any `{columns, rows}`, but the button was
   on the toner and warranty pages only - because those two happen to be their