feat(auth): add module read/write admin RBAC

Introduce permission catalog, PermissionsGuard, JWT/me payload with
role+permissions, and gate all module controllers. Admins CRUD accepts
role/permissions with safety rules; migrate existing users to super_admin.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/settings-proxy/settings-proxy.controller.ts

@@ -1,19 +1,23 @@
 import { Body, Controller, Get, Param, Post, UseGuards } from '@nestjs/common';
 import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { PermissionsGuard } from '../auth/permissions.guard';
+import { RequirePermissions } from '../auth/permissions.decorator';
 import { CurrentUser } from '../auth/current-user.decorator';
 import { SettingsProxyService } from './settings-proxy.service';
 
 @Controller('tenants/:tenantId/settings')
-@UseGuards(JwtAuthGuard)
+@UseGuards(JwtAuthGuard, PermissionsGuard)
 export class SettingsProxyController {
   constructor(private readonly settingsProxy: SettingsProxyService) {}
 
   @Get()
+  @RequirePermissions('hamkar:read', 'khanegi:read', { mode: 'any' })
   getSettings(@Param('tenantId') tenantId: string) {
     return this.settingsProxy.getSettings(tenantId);
   }
 
   @Post()
+  @RequirePermissions('hamkar:write', 'khanegi:write', { mode: 'any' })
   updateSettings(
     @Param('tenantId') tenantId: string,
     @Body() body: Record<string, unknown>,

src/settings-proxy/settings-proxy.module.ts

@@ -1,8 +1,10 @@
 import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
 import { SettingsProxyController } from './settings-proxy.controller';
 import { SettingsProxyService } from './settings-proxy.service';
 
 @Module({
+  imports: [AuthModule],
   controllers: [SettingsProxyController],
   providers: [SettingsProxyService],
 })