Web hides close/reopen from an issue's author, and close from an MR's author #311

issue close/issue reopen and mr close authorize with authorOrWrite: the author, or anyone with write access. The web renders those controls only on CanWrite, so an author without write access cannot close their own issue or merge request from the browser, though the server would accept it.

• internal/web/templates/issue.html: the State box (Close/Reopen issue) is inside {{if .CanWrite}}.
• internal/web/templates/mr.html: "Close without merging" is inside the {{if and .CanWrite ...}} Review/Merge block.

Both pages already compute CanEdit (canEditItem: author or write), which matches the command rule. Seen on ios-smoke/ui-smoke-edit#2, opened by cmc (no access to the repo): no Close button on the web; issue close over SSH closed it.