feat(auth): add module read/write admin RBAC

Introduce permission catalog, PermissionsGuard, JWT/me payload with
role+permissions, and gate all module controllers. Admins CRUD accepts
role/permissions with safety rules; migrate existing users to super_admin.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/schema.prisma

@@ -21,7 +21,7 @@ enum KhanegiUiVariant {
 
 enum UserRole {
   super_admin
-  viewer
+  admin
 }
 
 enum SmsLedgerType {
@@ -39,6 +39,8 @@ model User {
   email        String?    @unique
   passwordHash String     @map("password_hash")
   role         UserRole   @default(super_admin)
+  /// Permission codes for role=admin (ignored when role=super_admin)
+  permissions  Json       @default("[]")
   isActive     Boolean    @default(true) @map("is_active")
   createdAt    DateTime   @default(now()) @map("created_at")
   updatedAt    DateTime   @updatedAt @map("updated_at")