feat(auth): enforce admin permissions in UI

Add can()/router meta, HomePage module filtering, Admins permission
matrix, and hide write actions when the user lacks *:write.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/layouts/AppLayout.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { onMounted, ref } from 'vue'
+import { computed, onMounted, ref } from 'vue'
 import { useRouter } from 'vue-router'
 import { message } from 'ant-design-vue'
 import { LogoutOutlined, HomeOutlined } from '@ant-design/icons-vue'
@@ -10,6 +10,7 @@ const auth = useAuthStore()
 const router = useRouter()
 const adminSmsEnabled = ref(true)
 const smsToggleLoading = ref(false)
+const canSettingsWrite = computed(() => auth.can('settings:write'))
 
 function goHome() {
   router.push({ name: 'home' })
@@ -21,6 +22,7 @@ function logout() {
 }
 
 async function loadSmsToggle() {
+  if (!canSettingsWrite.value) return
   try {
     const { data } = await api.get('/settings/admin-sms')
     adminSmsEnabled.value = data.adminSmsEnabled !== false
@@ -30,6 +32,7 @@ async function loadSmsToggle() {
 }
 
 async function onSmsToggle(checked: boolean) {
+  if (!canSettingsWrite.value) return
   smsToggleLoading.value = true
   const previous = adminSmsEnabled.value
   adminSmsEnabled.value = checked
@@ -62,7 +65,11 @@ onMounted(loadSmsToggle)
       </button>
 
       <div class="topbar-actions">
-        <div class="sms-toggle" :class="{ off: !adminSmsEnabled }">
+        <div
+          v-if="canSettingsWrite"
+          class="sms-toggle"
+          :class="{ off: !adminSmsEnabled }"
+        >
           <span class="sms-toggle-label">پیامک هشدار</span>
           <a-switch
             :checked="adminSmsEnabled"