Collectors Settings shows the initial setup form to users who cannot create the ingest input

[kroepke]

Summary

On a cluster without a collectors config yet, the Collectors Settings page shows the full "Getting started" setup form to a user who cannot create inputs (e.g. Reader + built-in Collectors Manager role). The user can fill in the ingest endpoint and click "Confirm settings", the config is saved, but no ingest input is created and nothing tells them so. The result looks like a completed setup that can never receive data.

Steps to reproduce

1. Fresh cluster (no org.graylog.collectors.CollectorsConfig in cluster_config).
2. Log in as a user with the Reader and Collectors Manager roles (no inputs:create).
3. Open System → Collectors → Settings.

Expected

The page should say up front that an administrator needs to create the Collector Ingest input, instead of presenting a form that cannot complete the setup. The onboarding wizard on the Overview page already does this (see FirstOnboarding, gate on canCreateIngestInput from useCollectorPermissions).

Actual

• CollectorsSettings only hides the "Create ingest input" checkbox (showCreateInputCheckbox requires input permissions) but keeps the form and the submit button.
• The "Getting started with Collectors" alert still says "Configure the HTTP endpoint below and save to initialize the collector infrastructure".
• IngestEndpointStatus returns null while isInitialSetup && !hasInputs, so the missing input is never mentioned.

Notes

• Same root cause as the onboarding gate: the ingest input is a regular input, and the Collectors Manager role does not include inputs:create / input_types:create:org.graylog.collectors.input.CollectorIngestHttpInput (CollectorsPermissions#builtinRoles).
• Related: changing the external port on the Settings page does not move an existing ingest input either. The onboarding strip now does this via updateCollectorInputPort in useCollectorInputMutations; the Settings page could reuse it.