feat(auth): add module read/write admin RBAC

Introduce permission catalog, PermissionsGuard, JWT/me payload with
role+permissions, and gate all module controllers. Admins CRUD accepts
role/permissions with safety rules; migrate existing users to super_admin.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/migrations/20260810150000_admin_permissions/migration.sql

@@ -0,0 +1,25 @@
+-- Replace unused UserRole.viewer with admin + permissions JSON
+
+CREATE TYPE "UserRole_new" AS ENUM ('super_admin', 'admin');
+
+ALTER TABLE "users" ALTER COLUMN "role" DROP DEFAULT;
+
+ALTER TABLE "users"
+  ALTER COLUMN "role" TYPE "UserRole_new"
+  USING (
+    CASE
+      WHEN "role"::text = 'viewer' THEN 'admin'::"UserRole_new"
+      ELSE "role"::text::"UserRole_new"
+    END
+  );
+
+DROP TYPE "UserRole";
+
+ALTER TYPE "UserRole_new" RENAME TO "UserRole";
+
+ALTER TABLE "users" ALTER COLUMN "role" SET DEFAULT 'super_admin'::"UserRole";
+
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "permissions" JSONB NOT NULL DEFAULT '[]';
+
+-- Existing managers keep full access
+UPDATE "users" SET "role" = 'super_admin', "permissions" = '[]'::jsonb;

prisma/schema.prisma

@@ -21,7 +21,7 @@ enum KhanegiUiVariant {
 
 enum UserRole {
   super_admin
-  viewer
+  admin
 }
 
 enum SmsLedgerType {
@@ -39,6 +39,8 @@ model User {
   email        String?    @unique
   passwordHash String     @map("password_hash")
   role         UserRole   @default(super_admin)
+  /// Permission codes for role=admin (ignored when role=super_admin)
+  permissions  Json       @default("[]")
   isActive     Boolean    @default(true) @map("is_active")
   createdAt    DateTime   @default(now()) @map("created_at")
   updatedAt    DateTime   @updatedAt @map("updated_at")