fix: #3548769 by andres-alvarez: Secure API endpoints based on island availability

Add an IslandAccessCheck service that gates the publish/restore/revert endpoints to the StateButtons island and the save_as_preset endpoint to the MenuPreset island plus the 'administer pattern preset' permission.

Without this check, users could hit HTMX endpoints directly even when the corresponding island was disabled in the profile. The access check reads the instance profile and validates that the island plugin ID is present in the enabled islands list before allowing access.