fix(body-sites): skip the site suggestions read without the visits section

A delegate who may keep the illness journal but not read the visits
would be refused by GET /api/body-sites on every open of the condition
form, and each refusal writes an access-denied row. The field now asks
only when the grant covers the visits' section, and the condition page
shows the site as text rather than a link in that case.

Refs #1025

src/hooks/use-body-sites.ts

@@ -40,6 +40,18 @@ export function useBodySites(
   });
 }
 
+/**
+ * Whether the caller may ask for the list at all. It is read in the visits'
+ * section (`profile`), so a grant without it would be refused on every open;
+ * `null` or absent sections mean the whole record (one's own, or an
+ * entire-record grant).
+ */
+export function canReadBodySites(
+  sections: readonly string[] | null | undefined,
+): boolean {
+  return !sections || sections.includes("profile");
+}
+
 /**
  * The site names a body-site field suggests: every site the record holds,
  * most used first. A failed or refused read (a grant without the visits