feat(auth): enforce admin permissions in UI

Add can()/router meta, HomePage module filtering, Admins permission
matrix, and hide write actions when the user lacks *:write.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/pages/SmsTenantPage.vue

@@ -10,6 +10,7 @@ import MoneyInput from '@/components/MoneyInput.vue'
 import TenantPanelShortcuts from '@/components/TenantPanelShortcuts.vue'
 import { formatIranDateTime, todayIranDateInput } from '@/utils/datetime'
 import { formatMoney, formatNumber } from '@/utils/money'
+import { useAuthStore } from '@/stores/auth'
 
 type BalanceLevel = 'healthy' | 'warning' | 'critical' | 'unknown'
 
@@ -28,6 +29,8 @@ type SmsSummary = {
 
 const route = useRoute()
 const router = useRouter()
+const auth = useAuthStore()
+const canWrite = computed(() => auth.can('sms:write'))
 const loading = ref(false)
 const saving = ref(false)
 const charging = ref(false)
@@ -452,7 +455,15 @@ onMounted(async () => {
               <h3>تعرفه پیامک</h3>
               <div class="inline-actions">
                 <MoneyInput v-model:value="form.pricePerPartRials" placeholder="قیمت هر پارت" />
-                <a-button type="primary" size="large" :loading="saving" @click="savePrice">ذخیره قیمت</a-button>
+                <a-button
+                  v-if="canWrite"
+                  type="primary"
+                  size="large"
+                  :loading="saving"
+                  @click="savePrice"
+                >
+                  ذخیره قیمت
+                </a-button>
               </div>
             </div>
 
@@ -465,7 +476,13 @@ onMounted(async () => {
                   placeholder="مبلغ (تومان)"
                 />
                 <a-input v-model:value="chargeForm.note" size="large" placeholder="توضیح (اختیاری)" />
-                <a-button type="primary" size="large" :loading="charging" @click="openChargeConfirm">
+                <a-button
+                  v-if="canWrite"
+                  type="primary"
+                  size="large"
+                  :loading="charging"
+                  @click="openChargeConfirm"
+                >
                   شارژ کیف پول
                 </a-button>
               </div>
@@ -480,6 +497,7 @@ onMounted(async () => {
             <a-switch
               :checked="form.isBlocked"
               :loading="blockLoading"
+              :disabled="!canWrite"
               checked-children="مسدود"
               un-checked-children="فعال"
               @change="onBlockChange"
@@ -498,7 +516,14 @@ onMounted(async () => {
                 placeholder="راهنمای واریز"
               />
             </div>
-            <a-button type="primary" :loading="chargeInfoSaving" @click="saveChargeInfo">ذخیره اطلاعات واریز</a-button>
+            <a-button
+              v-if="canWrite"
+              type="primary"
+              :loading="chargeInfoSaving"
+              @click="saveChargeInfo"
+            >
+              ذخیره اطلاعات واریز
+            </a-button>
           </div>
 
           <div class="subcard thresholds">
@@ -512,7 +537,15 @@ onMounted(async () => {
                 <span class="tone-label"><i class="dot warning" /> آستانه زرد</span>
                 <MoneyInput v-model:value="form.alertWarningRials" />
               </label>
-              <a-button type="primary" size="large" :loading="saving" @click="saveThresholds">ذخیره آستانه‌ها</a-button>
+              <a-button
+                v-if="canWrite"
+                type="primary"
+                size="large"
+                :loading="saving"
+                @click="saveThresholds"
+              >
+                ذخیره آستانه‌ها
+              </a-button>
             </div>
           </div>
 
@@ -535,7 +568,13 @@ onMounted(async () => {
                   placeholder="مثلاً -50,000 — خالی = غیرفعال"
                 />
               </label>
-              <a-button type="primary" size="large" :loading="saving" @click="saveThresholds">
+              <a-button
+                v-if="canWrite"
+                type="primary"
+                size="large"
+                :loading="saving"
+                @click="saveThresholds"
+              >
                 ذخیره آستانه
               </a-button>
             </div>