fix: let users banned on Hackatime use Lapse

[anscg]

Problem

Hackatime returns 401 on every OAuth endpoint except /me for banned (red) users (ensure_api_access_allowed → api_access_restricted?). Lapse's linkStatus read that 401 as a dead token, so banned users got the "Reconnect Hackatime / Hackatime needs your permission again" modal and banner on every page. Signing in again could never fix it, and their Hackatime sync failed silently.

Fix

• linkStatus: when /projects returns 401, check /me. If /me still works, the token is fine and the user is restricted: return restricted: true and no relink prompt. Relink is only requested on a 403, or when /me also returns 401. Other Hackatime errors no longer prompt either.
• Contract: linkStatus gains restricted: boolean.
• Client: banned users skip the Hackatime step entirely. "Continue" publishes directly on the publish page, the draft page and the Lookout panel, and the "Sync with Hackatime" button is hidden. No notice is shown.
• Lookout panel context gains hackatimeRestricted (based on trust_factor.trust_level from /me).

Notes

• Not type-checked locally (no node_modules in my environment).
• Banned users still can't sync to Hackatime, because Hackatime won't hand out their API key over OAuth.

🤖 Generated with Claude Code

[anscg]

hi, this is urgent and i checked it end-to-end correctly. merging.