fix(cloud-control): remove App-level permission gate

cloud_control is the default landing surface for any authenticated
cloud user (create/manage their orgs and projects). Gating it on a
'cloud.control.access' permission was wrong — it would have hidden
the App from the very users it's built for.

Data-level isolation (which orgs/projects each user sees inside the
App) is enforced by sharing rules on sys_organization / sys_project,
not by an App-level requiredPermissions check.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

packages/services/service-tenant/src/apps/cloud-control.app.ts

@@ -32,9 +32,10 @@ export const CLOUD_CONTROL_APP: App = {
   branding: {
     primaryColor: '#2563eb', // Blue-600 — distinct from Setup's slate
   },
-  // Only org owners/admins see this app. The control-plane API itself
-  // also enforces this; nav-time check is cosmetic.
-  requiredPermissions: ['cloud.control.access'],
+  // No App-level permission gate: any authenticated user can open the
+  // Cloud Control App to create/manage their own organizations and
+  // projects. Data-level isolation (which orgs/projects each user sees)
+  // is enforced by sharing rules on sys_organization, sys_project, etc.
 
   navigation: [
     {