security: restrict cluster/pool selection to admin users only

Backend:
- ApplicationsService.create() now accepts userRole parameter
- Non-admin users have clusterId/poolId stripped automatically
- Logs warning when non-admin attempts manual cluster selection

Frontend:
- Deploy wizard hides cluster assignment mode selector for non-admin users
- Non-admin users see a simple 'Default Cluster' info box instead
- Cluster/pool API queries only execute for admin users (enabled: isAdmin)
- Review step shows 'Default Cluster' for non-admin regardless of form state

backend/src/applications/applications.controller.ts

@@ -42,7 +42,7 @@ export class ApplicationsController {
   @Post()
   @ApiOperation({ summary: 'Create a new application' })
   async create(@Request() req: any, @Body() dto: CreateApplicationDto) {
-    return this.applicationsService.create(req.user.id, dto);
+    return this.applicationsService.create(req.user.id, dto, req.user.role);
   }
 
   @Post(':id/upload')