feat(auth): enforce admin permissions in UI

Add can()/router meta, HomePage module filtering, Admins permission
matrix, and hide write actions when the user lacks *:write.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/pages/KhanegiModularUiConfigPage.vue

@@ -4,9 +4,12 @@ import { useRoute, useRouter } from 'vue-router'
 import { message } from 'ant-design-vue'
 import { ArrowRightOutlined } from '@ant-design/icons-vue'
 import api from '@/api/http'
+import { useAuthStore } from '@/stores/auth'
 
 const route = useRoute()
 const router = useRouter()
+const auth = useAuthStore()
+const canWrite = computed(() => auth.can('khanegi:write'))
 const loading = ref(true)
 const saving = ref(false)
 const switching = ref(false)
@@ -165,10 +168,18 @@ onMounted(load)
             { value: 'modular', label: 'Modular' },
             { value: 'newTheme', label: 'New theme' },
           ]"
-          :disabled="switching || saving || loading"
+          :disabled="!canWrite || switching || saving || loading"
           @change="(v: string) => v === 'newTheme' && switchToNewTheme()"
         />
-        <a-button type="primary" size="large" :loading="saving" @click="save">ذخیره</a-button>
+        <a-button
+          v-if="canWrite"
+          type="primary"
+          size="large"
+          :loading="saving"
+          @click="save"
+        >
+          ذخیره
+        </a-button>
       </a-space>
     </div>