Hide write-action controls in the tree UI when logged out

Delete (file and folder), download, upload, and new-folder were all
rendered unconditionally and relied on the backend's 401 + a redirect
to /login on click -- fine for surfacing the reason something failed,
but showing controls that plainly won't do anything until you log in
was the actual complaint. isLoggedIn() checks for the topbar's own
"Log out" link (only rendered when logged_in) instead of threading a
new flag through -- already there, and login state can't change
without a full page reload anyway.

Caught a real gap while verifying in a real browser: the folder row's
own delete button wasn't gated (only the file row's was), so a
"logged out" check still showed a delete icon on every folder. Fixed
before it shipped -- confirmed clean in both states afterward.

docs/architecture.adoc

@@ -691,6 +691,15 @@ require login, guarded by `require_login!` in `app.rb` — and so does
 exporting a file (`GET /api/gpx/file/*?download=...`), even though
 plain viewing of that same URL (no `?download`) doesn't; not a write
 exactly, but treated the same as the others rather than left open.
+The tree UI (`public/js/gpx.js`) mirrors this: every control for a
+gated action (delete, download, upload, new folder) is left out of
+the DOM entirely when logged out rather than shown and failing on
+click — `isLoggedIn()` checks for the topbar's own "Log out" link
+(`views/index.erb` only renders one when `logged_in`) instead of
+threading a separate flag through, since that's already there and
+login state can't change without a full page reload anyway. Delete
+exists on both file and folder rows — both are gated, easy to miss
+one and only catch it by testing an actually-logged-out session.
 
 Login delegates to the Gitea instance at `git.priesol.net` via OAuth2
 (`GET /login` redirects to Gitea's authorize endpoint, `GET