Ticket 1 — Configurable protection: mutate blocked; show & download independent

[jbagsik]

What to build

An admin can mark media as write-protected so replace, image-edit, and delete stay refused, while show/preview and download are configured independently (allow show+download, show-only, or neither). Today’s behaviour that treats protected items as non-downloadable is fixed for the “allow download” case. Filament UI and policy match.

Acceptance criteria

• Protected media cannot be updated, replaced, image-edited, or deleted (single and bulk).
• Show/preview and download are separately configurable; at least the combinations allow/allow, allow/deny, deny/deny are supported and documented.
• When download is allowed, protected media is downloadable in admin; when denied, download is refused.
• When show is denied, inline preview is not offered.
• Pest tests cover the protection/access matrix at the policy/UI behaviour seam (not Spatie internals).