feat(leads): gate export button on leads_api_access flag

Export button now only renders when event_exhibit.leads_api_access === true,
preventing a 403 that would always fire otherwise. Endpoint confirmed live on
backend. TODO updated to reflect export + allow_tracking gate both resolved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/TODO__Agents.md

@@ -68,11 +68,13 @@ Full audit: `src/routes/events/[event_id]/(leads)/` and `src/lib/ae_events/ae_ev
 - Tab 3 (List): SWR lead list, licensee filter (All / My Leads), sort options, export button
 - Tab 4 (Manage): admin tools, booth profile edit, passcode, license mgmt, custom questions config, app settings (refresh interval, clear IDB/localStorage, reload)
 - Lead detail page: view/edit custom question responses, exhibitor notes (TipTap), priority/enable flags
-- Export wired to legacy `/event/exhibit/{id}/tracking/export` endpoint (CSV; confirm backend is live)
+- Export wired to V3 action endpoint `/v3/action/event_exhibit/{id}/tracking_export` (CSV/XLSX)
 
 **Remaining before demo:**
-- [ ] **Verify export endpoint** — `download_export__event_exhibit_tracking` calls legacy endpoint
-  `/event/exhibit/{exhibit_id}/tracking/export` — confirm it's live on the backend
+- [x] **Export endpoint** — V3 action endpoint confirmed live on backend (2026-03-16). Returns 403 if
+  `leads_api_access` is not enabled on the exhibit — expected behavior. Export button now gated in
+  UI: only renders when `$lq__exhibit_obj?.leads_api_access === true`. Enable via:
+  `PATCH /v3/crud/event_exhibit/{id}` with `{ "leads_api_access": true }`.
 - [x] **`allow_tracking` gate** — implemented (2026-03-16). QR scanner shows a warning card and
   blocks the add. Manual search shows a ShieldOff "Opt-Out" badge per row and guards `add_as_lead`.
   Opt-in model: `allow_tracking` must be explicitly `true` on the badge. Also added `allow_tracking`

src/routes/events/[event_id]/(leads)/leads/exhibit/[exhibit_id]/+page.svelte

@@ -457,13 +457,15 @@
                 <div class="w-full flex flex-col space-y-6">
                     <div class="flex justify-between items-center px-2">
                         <h2 class="text-xl sm:text-2xl font-bold">Lead List</h2>
-                        <button
-                            type="button"
-                            class="btn btn-sm preset-outlined-secondary"
-                            onclick={handle_export}
-                        >
-                            <Download size="1.2em" class="mr-2" /> Export
-                        </button>
+                        {#if $lq__exhibit_obj?.leads_api_access === true}
+                            <button
+                                type="button"
+                                class="btn btn-sm preset-outlined-secondary"
+                                onclick={handle_export}
+                            >
+                                <Download size="1.2em" class="mr-2" /> Export
+                            </button>
+                        {/if}
                     </div>
 
                     <Comp_exhibit_tracking_search exhibit_id={page.params.exhibit_id ?? ''} />