fix(settings): list record content only where the grant manages it

The anamnesis page writes through requireRecordAuth("manage",
"profile"), which refuses a grant whose sections do not reach profile.
The Settings list and the navigation entry checked only the level and
the record kind, so a MANAGE grant scoped away from profile would be
offered a page whose saves are refused.

Record-content destinations now name the section they write, and are
listed only when the active record's manageable sections include it.
A destination without a named section is never listed. The shell and
the navigation read the same predicate. MANAGE grants are whole-record
today, so managed profiles and adult MANAGE shares list what they did
before.

Refs #939

src/__tests__/managed-record-navigation.test.tsx

@@ -3,6 +3,7 @@ import { renderToStaticMarkup } from "react-dom/server";
 
 import { I18nProvider } from "@/lib/i18n/context";
 import { classifySettingsDestination } from "@/lib/record-settings";
+import { delegatedDomains } from "@/lib/sharing/domain-write-support";
 
 const pathnameRef = { value: "/settings/security" };
 const activeRecordRef = { value: true };
@@ -31,6 +32,12 @@ vi.mock("@/hooks/use-auth", () => ({
               recordKind: recordRef.value.kind,
               sections: null,
               canWrite: true,
+              // Bound as the server publishes it for a whole-record grant.
+              manageableDomains: delegatedDomains(
+                recordRef.value.level as "read" | "write" | "manage",
+                null,
+                "manage",
+              ),
             },
             accounts: [],
             canSwitch: true,