spp.graduation.assessment gated its approve/reject/reset buttons to the
graduation manager group in the VIEW only. The Python workflow methods checked
just the state transition, and group_spp_graduation_user has write/create on
their own assessments (assessor_id == user). So a normal user could, via RPC,
self-approve their own assessment (action_submit then action_approve, setting a
graduation_date) or bypass the methods entirely with a raw
write({'state':'approved', ...}) / create({'state':'approved', ...}).

Enforce the boundary server-side:
- action_approve/action_reject/action_reset_draft raise AccessError unless the
  caller is a graduation manager (superuser/sudo exempt for system flows).
- create()/write() forbid non-managers from setting the manager-only outcome
  fields (approved_by_id, approved_date, graduation_date) and from moving state
  beyond the one user-allowed transition draft -> submitted (create must be
  draft). Closes the raw-RPC bypass.
action_submit stays user-allowed.

Tests: user cannot approve/reject/reset own assessment, cannot write approved
state or approval fields, cannot create a non-draft assessment; manager can
still approve (graduation_date set); user can still submit. spp_graduation 54/54.

Address Gemini review (security-high) on PR #267: the ORM guards blocked state
changes and the manager-only outcome fields, but a non-manager assessor could
still edit content (recommendation, partner_id, responses, ...) on an already
submitted/approved/rejected assessment — e.g. submit recommendation='extend',
flip to 'graduate' while pending, and the manager's approval then sets a
graduation_date for a recommendation they did not review.

Freeze the assessor-editable content fields (partner_id, pathway_id,
assessment_date, recommendation, recommendation_notes, response_ids) for
non-managers once the assessment leaves draft; editing requires a manager reset
to draft. Only these business fields are frozen, so chatter/activity/technical
writes on submitted records are unaffected. Manager/superuser unrestricted.

Test: a user cannot change recommendation/notes on a submitted assessment.
spp_graduation 58/58.