Migrate UI provider guards to capability checks

[dgershman]

Follow-up to #410 / ADR 0005.

Two UI sites today hide buttons by checking session.provider == .github:

• Sources/Crow/Views/SessionDetailView.swift:176
• Sources/Crow/Views/SessionListView.swift:303

With TaskCapability / CodeCapability in place, the view models should
expose capability flags and the views key off those instead. UI should not
need to know about specific providers.

Acceptance

• Both sites use capability-driven visibility (e.g. viewModel.canSetProjectStatus)
  rather than provider equality.
• New capability accessors in view models are tested.

References:

• ADR 0005: docs/adr/0005-task-and-code-backend-protocols.md
• PR Extract TaskBackend + CodeBackend protocols (#410) #411