feat(auth): add module read/write admin RBAC

Introduce permission catalog, PermissionsGuard, JWT/me payload with
role+permissions, and gate all module controllers. Admins CRUD accepts
role/permissions with safety rules; migrate existing users to super_admin.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/notifications/notifications.module.ts

@@ -1,10 +1,12 @@
 import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
 import { AdminNotifyService } from './admin-notify.service';
 import { CentralSmsService } from './central-sms.service';
 import { RuntimeSettingsController } from './runtime-settings.controller';
 import { RuntimeSettingsService } from './runtime-settings.service';
 
 @Module({
+  imports: [AuthModule],
   controllers: [RuntimeSettingsController],
   providers: [CentralSmsService, AdminNotifyService, RuntimeSettingsService],
   exports: [CentralSmsService, AdminNotifyService, RuntimeSettingsService],

src/notifications/runtime-settings.controller.ts

@@ -1,19 +1,23 @@
 import { Body, Controller, Get, Patch, UseGuards } from '@nestjs/common';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { PermissionsGuard } from '../auth/permissions.guard';
+import { RequirePermissions } from '../auth/permissions.decorator';
 import { UpdateAdminSmsDto } from './dto/update-admin-sms.dto';
 import { RuntimeSettingsService } from './runtime-settings.service';
 
 @Controller('settings')
-@UseGuards(JwtAuthGuard)
+@UseGuards(JwtAuthGuard, PermissionsGuard)
 export class RuntimeSettingsController {
   constructor(private readonly settings: RuntimeSettingsService) {}
 
   @Get('admin-sms')
+  @RequirePermissions('settings:write')
   getAdminSms() {
     return this.settings.getPublic();
   }
 
   @Patch('admin-sms')
+  @RequirePermissions('settings:write')
   setAdminSms(@Body() dto: UpdateAdminSmsDto) {
     this.settings.setAdminSmsEnabled(dto.enabled);
     return this.settings.getPublic();