fix: add role-based permissions to forms page

- Hide Generate Default Template and Save Changes buttons for wizard/observer
- Backend already enforces owner/researcher for mutations
- UI now provides cleaner experience for read-only roles

src/app/(dashboard)/studies/[id]/forms/page.tsx

@@ -254,6 +254,9 @@ export default function StudyFormsPage({ params }: StudyFormsPageProps) {
 
   if (!study) return <div>Loading...</div>;
 
+  const userRole = (study as any)?.userRole;
+  const canManage = userRole === "owner" || userRole === "researcher";
+
   return (
     <EntityView>
       <PageHeader
@@ -268,6 +271,7 @@ export default function StudyFormsPage({ params }: StudyFormsPageProps) {
           icon="FileText"
           description="Design and manage the consent form that participants must sign before participating in your trials."
           actions={
+            canManage ? (
               <div className="flex gap-2">
                 <Button
                   variant="outline"
@@ -310,6 +314,7 @@ export default function StudyFormsPage({ params }: StudyFormsPageProps) {
                   </Button>
                 )}
               </div>
+            ) : null
           }
         >
           {activeConsentForm ? (