Limit which sections a team member can see, the way a share link can

I run Umami for a handful of client sites. Each site belongs to a team, the client is a team-view-only member of their own team, and they log in to see their own analytics. That part works, and #4539 makes the Websites list agree with it.

What I can't do is control how much they see. A share link can: its parameters decide which sections the public link shows. A logged-in member gets everything the website has, including sessions, individual session detail, session replays, revenue and reports. For some clients that is more than I want to hand over, and where replay is enabled it is other people's browsing.

So the choice today is a share link, which is public to anyone holding the URL and not revocable per person, or a login, which is revocable but all or nothing.

Would you take a change that limits which sections a member can see, and if so in what shape? A few options, in rough order of how much they change:

1. Per member, stored on team_user, set when you add or edit the member.
2. Per team, one setting that view-only members inherit.
3. One or more new roles with a fixed, narrower set of sections.

Whichever way the setting is stored, the check needs to run on the API routes rather than only hiding nav items, or it is decoration.

I am happy to do the work, tests included. I have just opened #4539 in the same area. I would rather agree the shape with you before writing anything than send a PR you did not ask for.