fix(vpn): keep the navigation entry after the capability split

The sidebar still gated the VPN entry on vpn.manage, which the split deleted —
so the page would have vanished from the console for every role, Owner
included. Every operator can hold their own access, so the entry is shown to
all of them and the page itself shows only what the policy allows. Guarded by a
test across all five roles, which is the assertion my rewrite had dropped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

resources/views/layouts/admin.blade.php

@@ -36,7 +36,7 @@
                     ['admin.datacenters', 'database', 'datacenters', null],
                     ['admin.provisioning', 'activity', 'provisioning', null],
                     ['admin.maintenance', 'alert-triangle', 'maintenance', null],
-                    ['admin.vpn', 'shield', 'vpn', 'vpn.manage'],
+                    ['admin.vpn', 'shield', 'vpn', null],
                     ['admin.revenue', 'trending-up', 'revenue', null],
                 ] as [$route, $icon, $key, $capability])
                     @continue($capability !== null && ! auth()->user()?->can($capability))

tests/Feature/Admin/VpnTest.php

@@ -24,6 +24,18 @@ function vpnHub(): FakeWireguardHub
     return $hub;
 }
 
+it('keeps the VPN entry in the navigation for every operator', function () {
+    vpnHub();
+
+    // Regression guard: the entry used to hang on a capability that the
+    // capability split deleted, which would have hidden the page from everyone.
+    foreach (['Owner', 'Admin', 'Support', 'Developer', 'Read-only'] as $role) {
+        $this->actingAs(operator($role))->get(route('admin.overview'))
+            ->assertOk()
+            ->assertSee(route('admin.vpn'));
+    }
+});
+
 it('shows each operator only their own access unless they may see all', function () {
     vpnHub();
     $support = operator('Support');