Fix privilege escalation allowing granted users to delete collections

[cursor]

Summary

• identified a critical authorization regression introduced in recent collection-access changes
• restricted collection rename/delete permissions to owner and creator only
• added a regression test for canRenameOrDeleteCollection to ensure grant users cannot perform destructive collection operations
• adjusted the test to mock Prisma so it runs in CI without DB env setup

Validation

• npm test -- src/server/access/collections.test.ts
• npm test

Impact

This prevents granted (shared) users from deleting or renaming entire collections, which could otherwise cause destructive data loss for other users.