On lists where users do not have posting permissions, the "new post" button is hidden in the sidebar but not on the top (where the "archives" tab is).
I think we could easily do this with a simple:
{% if ListAccess.post in access %} [stuff here] {% endif %}
But that would also remove the button for someone browsing unauthenticated on the site, whose email would still have post access. Does that matter or should it be removed anyhow?
If someone was explicitly added to the ACL, then whoever added them can give them the posting address while they're at it.
For reference: patch at https://lists.sr.ht/~sircmpwn/sr.ht-dev/patches/10355.
Fixed with 09efc588.