feat: implement complete RBAC access control with tests

Add 4-layer access control stack (subscription → module → menu → permissions):
- P1: Wire requires_permission into menu sidebar filtering
- P2: Expose window.USER_PERMISSIONS for Alpine.js client-side gating
- P3: Add page-level permission guards on store routes
- P4: Role CRUD API endpoints and role editor UI
- P5: Audit trail for all role/permission changes

Includes unit tests (menu permission filtering, role CRUD service) and
integration tests (role API endpoints). All 404 core+tenancy tests pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/orders/definition.py

@@ -133,6 +133,7 @@ orders_module = ModuleDefinition(
                         route="/store/{store_code}/orders",
                         order=10,
                         is_mandatory=True,
+                        requires_permission="orders.view",
                     ),
                 ],
             ),

app/modules/orders/routes/pages/store.py

@@ -12,9 +12,9 @@ from fastapi.responses import HTMLResponse
 from sqlalchemy.orm import Session
 
 from app.api.deps import (
-    get_current_store_from_cookie_or_header,
     get_db,
     get_resolved_store_code,
+    require_store_page_permission,
 )
 from app.modules.core.utils.page_context import get_store_context
 from app.modules.tenancy.models import User
@@ -34,7 +34,7 @@ router = APIRouter()
 async def store_orders_page(
     request: Request,
     store_code: str = Depends(get_resolved_store_code),
-    current_user: User = Depends(get_current_store_from_cookie_or_header),
+    current_user: User = Depends(require_store_page_permission("orders.view")),
     db: Session = Depends(get_db),
 ):
     """
@@ -56,7 +56,7 @@ async def store_order_detail_page(
     request: Request,
     store_code: str = Depends(get_resolved_store_code),
     order_id: int = Path(..., description="Order ID"),
-    current_user: User = Depends(get_current_store_from_cookie_or_header),
+    current_user: User = Depends(require_store_page_permission("orders.view")),
     db: Session = Depends(get_db),
 ):
     """