feat(auth): enforce admin permissions in UI

Add can()/router meta, HomePage module filtering, Admins permission
matrix, and hide write actions when the user lacks *:write.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/pages/TenantFormPage.vue

@@ -4,9 +4,11 @@ import { useRoute, useRouter } from 'vue-router'
 import { message } from 'ant-design-vue'
 import { ArrowRightOutlined, PlusOutlined, DeleteOutlined } from '@ant-design/icons-vue'
 import api from '@/api/http'
+import { useAuthStore } from '@/stores/auth'
 
 const route = useRoute()
 const router = useRouter()
+const auth = useAuthStore()
 const loading = ref(false)
 const saving = ref(false)
 const uploading = ref(false)
@@ -32,6 +34,9 @@ const form = reactive({
 })
 
 const productLabel = computed(() => (form.product === 'hamkar' ? 'همکار' : 'خانگی'))
+const canWrite = computed(() =>
+  form.product === 'hamkar' ? auth.can('hamkar:write') : auth.can('khanegi:write'),
+)
 
 function backTarget() {
   return {
@@ -104,6 +109,10 @@ function clearLogo() {
 }
 
 async function save() {
+  if (!canWrite.value) {
+    message.warning('دسترسی نوشتن ندارید')
+    return
+  }
   saving.value = true
   try {
     const payload = { ...form }
@@ -256,7 +265,16 @@ onMounted(load)
       </section>
 
       <div class="sticky-actions">
-        <a-button type="primary" html-type="submit" size="large" block :loading="saving">ذخیره</a-button>
+        <a-button
+          v-if="canWrite"
+          type="primary"
+          html-type="submit"
+          size="large"
+          block
+          :loading="saving"
+        >
+          ذخیره
+        </a-button>
         <a-button size="large" @click="router.push(backTarget())">انصراف</a-button>
       </div>
     </a-form>