CNS-137: un-gate the query history view in self-managed console builds

[jubrad]

Linear: https://linear.app/materializeinc/issue/CNS-137/console-un-gate-the-query-history-view-in-self-managed-builds

Problem

The console's query history view was hard-gated to Cloud: self-managed users hitting /query-history were silently redirected home, and the Monitoring > Query History nav item was hidden.

Solution

Remove both gates. The feature code already supports self-managed (QueryHistoryRoutes has a working self-managed branch that simply leaves the default user filter unset). With the nav item unconditional, the canViewQueryHistory plumbing through getNavItems was dead, so it is gone too.

Testing

ci/test/console/test.sh / ci/test/console/lint.sh equivalents locally (yarn lint, yarn typecheck, vitest for the touched dirs). One new test, verified to fail without the change: AuthenticatedRoutes.test.tsx asserts /regions/:slug/query-history renders the page in a self-managed deployment instead of redirecting home. The nav entry is now an unconditional literal in a static list, so it gets no test.

RBAC finding (requested by the issue)

A self-managed role without mz_monitor gets the existing UnauthorizedState, not a blank page or error boundary. The privilege probe hardcodes builtin OIDs (16748 mz_recent_activity_log, 16750 mz_statement_lifecycle_history), both of which still match src/pgrepr-consts/src/oid.rs, and isAuthorizedSelector requires SELECT on mz_statement_lifecycle_history, which needs mz_monitor. That path is already covered by an existing QueryHistoryList test and is deployment-mode agnostic.

For the reviewer

• The UnauthorizedState doc link points at the Cloud access-control docs (/docs/security/cloud/access-control/manage-roles/). Pre-existing, but self-managed users can now reach it. Left alone to avoid colliding with CNS-138, which owns QueryHistoryList.tsx.
• Merge order: this must land after CNS-136 (Helm chart stops hard-disabling statement logging). Nothing here depends on it at build time, but until that ships, a self-managed console user reaching this view sees an empty list because sampling is off.