feat: Excel export of all projects for full-access admins

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/full-access.guard.ts

@@ -0,0 +1,21 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { isFullAccessRole } from './permissions';
+
+/** Only role=super_admin (full access). Limited admins are blocked. */
+@Injectable()
+export class FullAccessGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const user = context.switchToHttp().getRequest()?.user as
+      | { role?: string | null }
+      | undefined;
+    if (!isFullAccessRole(user?.role)) {
+      throw new ForbiddenException('فقط مدیران با دسترسی کامل می‌توانند این کار را انجام دهند');
+    }
+    return true;
+  }
+}