feat(leads): gate export button on leads_api_access flag

Export button now only renders when event_exhibit.leads_api_access === true,
preventing a 403 that would always fire otherwise. Endpoint confirmed live on
backend. TODO updated to reflect export + allow_tracking gate both resolved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/routes/events/[event_id]/(leads)/leads/exhibit/[exhibit_id]/+page.svelte

@@ -457,13 +457,15 @@
                 <div class="w-full flex flex-col space-y-6">
                     <div class="flex justify-between items-center px-2">
                         <h2 class="text-xl sm:text-2xl font-bold">Lead List</h2>
-                        <button
-                            type="button"
-                            class="btn btn-sm preset-outlined-secondary"
-                            onclick={handle_export}
-                        >
-                            <Download size="1.2em" class="mr-2" /> Export
-                        </button>
+                        {#if $lq__exhibit_obj?.leads_api_access === true}
+                            <button
+                                type="button"
+                                class="btn btn-sm preset-outlined-secondary"
+                                onclick={handle_export}
+                            >
+                                <Download size="1.2em" class="mr-2" /> Export
+                            </button>
+                        {/if}
                     </div>
 
                     <Comp_exhibit_tracking_search exhibit_id={page.params.exhibit_id ?? ''} />