Render an app with viewer_surface='dashboard'.

Mirrors the access-control machinery of /apps/{app_id}: owners always render, link_view promotes any caller to a viewer, and an explicit share grant gives the holder viewer/editor access.

This is the Phase 7 MVP renderer. It reads the dashboard payload from get_app(), reads the blocks, partitions displayed roots from their hidden subtree, and renders each root in its layout cell. The full iframe-per-block + bb-bridge interactivity wiring is the next chunk of work; today the block body shows the source so the end-to-end dataflow is visible.