feat(admin): birth date on the customer forms; permission saves limited to known rids (PERS-03, SEC-07)

- PERS-03: «تاریخ تولد» (Jalali DateInput) on the wholesale and retail
  forms, as legacy. The server accepts birth_date or birth_day, refuses
  impossible or future dates, clears on '', and returns both names.
- SEC-07: setRoles stores only rids in ALL_RIDS or their tree parents.
  Anything else is dropped with a warning log, so a tick on a legacy-only
  tree leaf never fails the save.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/modules/admin-users/admin-users.roles.spec.ts

@@ -0,0 +1,31 @@
+import { AdminUsersService } from './admin-users.service';
+
+/** SEC-07: a role's saved permissions are limited to rids the server knows. */
+describe('AdminUsersService.setRoles', () => {
+  let createMany: jest.Mock;
+  let service: AdminUsersService;
+
+  beforeEach(() => {
+    createMany = jest.fn();
+    const prisma = {
+      userType: { findUnique: jest.fn(async () => ({ id: 90, permissions: [] })) },
+      permission: { deleteMany: jest.fn(), createMany },
+      $transaction: jest.fn(async () => []),
+    };
+    service = new AdminUsersService(prisma as never, {} as never, {} as never);
+  });
+
+  it('keeps catalogue rids and their tree parents, drops anything else', async () => {
+    await service.setRoles(90, [
+      'order.list',
+      'order', // tree parent of order.list
+      'persons', // tree parent of persons.*
+      'notify.create.single.customer', // legacy tree leaf no route checks
+      'made.up.permission',
+      'order.list', // duplicate
+      '',
+    ]);
+    const rows = createMany.mock.calls[0][0].data.map((d: { rid: string }) => d.rid);
+    expect(rows.sort()).toEqual(['order', 'order.list', 'persons']);
+  });
+});