Fix action/resource on namespace-deactivate and node-copy access checks

[ruizhang0519]

Tracking: #2234 (step 0, action/resource correctness). Route coverage is handled separately in #2334.

Two endpoints have called AccessChecker.check() since the RBAC engine was wired in (#1579), but with the wrong argument:

• deactivate_a_namespace required WRITE for a delete-class operation (it can cascade-delete nodes). A DELETE grant implies WRITE, so requiring WRITE is strictly weaker than intended and lets a WRITE-only caller delete. Now requires DELETE, matching node deactivation and namespace hard-delete.
• copy_node passed the full new node name to add_namespace, so the WRITE check targeted a bogus namespace instead of the new node's parent. Now uses the already-computed new_node_namespace.

No-op under the permissive default; only takes effect once a deployment enables restrictive RBAC.

Tests (tests/api/access_correctness_test.py) fail before and pass after: a WRITE-but-not-DELETE caller is denied on namespace deactivate, and copy_node authorizes the parent namespace rather than the full new name.

[netlify]

✅ Deploy Preview for thriving-cassata-78ae72 canceled.

Name	Link
🔨 Latest commit	9feac27
🔍 Latest deploy log	https://app.netlify.com/projects/thriving-cassata-78ae72/deploys/6a602d43917ca30008db3189