fix: enforce rollout gates across backend entry points

src/lib/server/application.ts

@@ -57,9 +57,13 @@ export async function assetReport(
   capability: Extract<ReleaseCapability, 'asset_search' | 'asset_valuation'> = 'asset_valuation',
 ) {
   const config = configuration();
-  if (!capabilityEnabled(capability, config.capabilityAllowlist)) {
-    return { status: 'unavailable' as const, reason: capabilityDisabledReason(capability) };
-  }
+  // The current shared report includes reference valuation even for the browse
+  // page. Do not let an asset_search-only rollout accidentally expose it.
+  const requiredCapabilities: readonly ReleaseCapability[] = capability === 'asset_search'
+    ? ['asset_search', 'asset_valuation']
+    : ['asset_valuation'];
+  const disabled = requiredCapabilities.find((required) => !capabilityEnabled(required, config.capabilityAllowlist));
+  if (disabled) return { status: 'unavailable' as const, reason: capabilityDisabledReason(disabled) };
   let reference: SqliteReferenceRepository | undefined;
   const getReference = () => {
     const config = configuration();