feat: dashboard route gated on canSeeOrgAdmin

Relax the dashboard route from canSeeAdmin (strict platform admin)
to canSeeOrgAdmin so the access seam can widen the audience past
the platform admin — by default platform admin, plus whatever an
access extension chooses to admit. The dashboard endpoint takes
care of scoping the response per caller.

Also move Dashboard under the canSeeOrgAdmin bullet in the
access.ts predicate notes.

src/access.ts

@@ -14,10 +14,10 @@ export default (initialState: { currentUser?: Global.UserInfo }) => {
 
   // Predicate roles, top-down by strictness:
   //   * `canSeeAdmin` — strictly platform admin (`users.is_admin`).
-  //     Gates Users, Dashboard.
+  //     Gates Users.
   //   * `canSeeOrgAdmin` — admin-style menus that work cross-org
-  //     (Resources, Models, Cluster Management). Defaults to platform
-  //     admin; extensions widen to include org admins.
+  //     (Dashboard, Resources, Models, Cluster Management). Defaults
+  //     to platform admin; extensions widen to include org admins.
   //   * `canManageCurrentOrg` — pages that only make sense inside a
   //     specific org context (member / group management). Defaults to
   //     `false`; extensions widen when both an org is selected AND