feat(auth): add module read/write admin RBAC

Introduce permission catalog, PermissionsGuard, JWT/me payload with
role+permissions, and gate all module controllers. Admins CRUD accepts
role/permissions with safety rules; migrate existing users to super_admin.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/migrations/20260810150000_admin_permissions/migration.sql

@@ -0,0 +1,25 @@
+-- Replace unused UserRole.viewer with admin + permissions JSON
+
+CREATE TYPE "UserRole_new" AS ENUM ('super_admin', 'admin');
+
+ALTER TABLE "users" ALTER COLUMN "role" DROP DEFAULT;
+
+ALTER TABLE "users"
+  ALTER COLUMN "role" TYPE "UserRole_new"
+  USING (
+    CASE
+      WHEN "role"::text = 'viewer' THEN 'admin'::"UserRole_new"
+      ELSE "role"::text::"UserRole_new"
+    END
+  );
+
+DROP TYPE "UserRole";
+
+ALTER TYPE "UserRole_new" RENAME TO "UserRole";
+
+ALTER TABLE "users" ALTER COLUMN "role" SET DEFAULT 'super_admin'::"UserRole";
+
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "permissions" JSONB NOT NULL DEFAULT '[]';
+
+-- Existing managers keep full access
+UPDATE "users" SET "role" = 'super_admin', "permissions" = '[]'::jsonb;