chore(deps): @casl/ability v7 parity in api + drop @casl/react

Follow-up to #104, which bumped @casl/ability to 7.0.0 in ui only.

- api: @casl/ability 6.8.1 -> 7.0.0 (keeps the shared ACL model in parity; api
  was left on v6 by #104).
- ui: drop @casl/react. v7 removed createContextualCan, the only API the UI used
  from it, and #104 left @casl/react@6 paired with @casl/ability@7 (peer
  mismatch). Reimplement the small <Can> directly over the existing typed
  AbilityContext instead of pulling v7's AbilityProvider/useAbility (which would
  replace the template's deliberate AbilityContext + emptyAbility design and its
  tests). That makes @casl/react unused, so it's removed.

Validated: bun run check (api, ui), ACL suites (api 50, ui 13), ui build; bun
install --frozen-lockfile clean in both apps.

Author: agjs

apps/api/bun.lock

@@ -51,7 +51,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "0.98.0",
-    "@casl/ability": "6.8.1",
+    "@casl/ability": "7.0.0",
     "@elysiajs/cors": "1.4.2",
     "@elysiajs/jwt": "1.4.2",
     "@elysiajs/swagger": "1.3.1",

apps/api/package.json

@@ -59,7 +59,6 @@
   },
   "dependencies": {
     "@casl/ability": "7.0.0",
-    "@casl/react": "6.0.0",
     "@hookform/resolvers": "5.2.2",
     "@sentry/react": "10.53.1",
     "@tanstack/react-query": "5.100.14",

apps/ui/bun.lock

@@ -1,12 +1,44 @@
-import { createContextualCan } from "@casl/react";
+import type { ReactNode } from "react";
 
-import { AbilityContext } from "./acl.context";
+import type { Action, Subject } from "./acl.types";
+import { useCan } from "./useCan";
+
+interface ICanProps {
+  /** Action to check, e.g. `"manage"`. */
+  readonly I: Action;
+  /** Subject to check the action against, e.g. `"Site"`. */
+  readonly a: Subject;
+  /** Invert the check — render when the ability *denies* the action. */
+  readonly not?: boolean;
+  /** Render children regardless; only meaningful with a render-prop child. */
+  readonly passThrough?: boolean;
+  readonly children: ReactNode | ((allowed: boolean) => ReactNode);
+}
 
 /**
  * Typed `<Can I="manage" a="Site">{children}</Can>` over the active
- * membership's ability. Wraps @casl/react's contextual consumer so call
- * sites don't have to thread the ability prop themselves.
+ * membership's ability (read from `<AbilityProvider>` via `useCan`).
+ *
+ * Replaces `@casl/react`'s `createContextualCan`, removed in v7. The rest of
+ * the ACL layer keeps its own typed `AbilityContext` + `emptyAbility` default
+ * (so a pre-`/me` tree denies everything), so binding `Can` to that context
+ * here is all that's needed.
  *
  * Render-gating only — the server enforces every action independently.
  */
-export const Can = createContextualCan(AbilityContext.Consumer);
+export function Can({
+  I,
+  a,
+  not = false,
+  passThrough = false,
+  children
+}: ICanProps): ReactNode {
+  const ability = useCan();
+  const allowed = not ? ability.cannot(I, a) : ability.can(I, a);
+
+  if (typeof children === "function") {
+    return children(allowed);
+  }
+
+  return allowed || passThrough ? children : null;
+}