Add viewer access to records and restrict activity log

- canView() + canViewAny() in EnforcesRoles: all SMS roles can view
- View pages for all 7 resources so viewers can open records read-only
- Custom ActivityResource restricts activity log to admin + manager only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Filament/User/Resources/SpiceSupplierResource.php

@@ -163,6 +163,7 @@ class SpiceSupplierResource extends Resource
         return [
             'index' => Pages\ListSpiceSuppliers::route('/'),
             'create' => Pages\CreateSpiceSupplier::route('/create'),
+            'view' => Pages\ViewSpiceSupplier::route('/{record}'),
             'edit' => Pages\EditSpiceSupplier::route('/{record}/edit'),
         ];
     }