feat(rbac): implement full admin management, dynamic roles, permissions matrix, and workspace access control

- Add Workspace, Role, Permission, RolePermission, AdminRoleAssignment, and AdminWorkspaceAssignment models to Prisma schema\n- Create database migration and RBAC seed script\n- Implement PermissionsGuard, @RequirePermission decorator, and real-time permission resolution in JwtAdminStrategy\n- Implement AdminManagementModule with endpoints for managers CRUD, roles matrix, permissions catalog, and workspaces\n- Secure all sensitive admin controllers with granular permission requirements\n- Add useAuthStore helpers (can, canAny, fetchMe) and v-permission directive\n- Implement Desktop views: AdminListView, AdminFormDrawer (RTL right-side), RoleMatrixView, WorkspaceListView, and ForbiddenView\n- Implement Mobile views: MAdminListView, MAdminFormView (stepped mobile form), MRoleMatrixView, MWorkspaceListView, and MForbiddenView\n- Fix sticky header behavior across desktop and mobile shells\n- Update route guards and device detection logic for mobile prefixing

apps/api/src/modules/winner/admin-spin.controller.ts

@@ -10,18 +10,21 @@ import {
 import { ApiBearerAuth, ApiOperation, ApiQuery, ApiTags } from '@nestjs/swagger';
 import { Response } from 'express';
 import { JwtAdminGuard } from '../../common/guards/jwt-admin.guard';
+import { PermissionsGuard } from '../../common/guards/permissions.guard';
+import { RequirePermission } from '../../common/decorators/require-permission.decorator';
 import { AuditInterceptor } from '../../common/interceptors/audit.interceptor';
 import { WinnerService } from './winner.service';
 
 @ApiTags('Admin Spins (تاریخچه اسپین‌ها)')
 @Controller('admin/spins')
-@UseGuards(JwtAdminGuard)
+@UseGuards(JwtAdminGuard, PermissionsGuard)
 @UseInterceptors(AuditInterceptor)
 @ApiBearerAuth('AdminAuth')
 export class AdminSpinController {
   constructor(private readonly winnerService: WinnerService) {}
 
   @Get()
+  @RequirePermission('spins:read')
   @ApiOperation({ summary: 'لیست تاریخچه تمام چرخاندن‌های گردونه با فیلتر و جستجو' })
   @ApiQuery({ name: 'page', required: false })
   @ApiQuery({ name: 'pageSize', required: false })
@@ -33,6 +36,7 @@ export class AdminSpinController {
   }
 
   @Get('export')
+  @RequirePermission('reports:export')
   @ApiOperation({ summary: 'خروجی فایل اکسل از تاریخچه تمام اسپین‌ها' })
   @Header('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet')
   @Header('Content-Disposition', 'attachment; filename=spins.xlsx')