feat: implement complete RBAC access control with tests

Add 4-layer access control stack (subscription → module → menu → permissions):
- P1: Wire requires_permission into menu sidebar filtering
- P2: Expose window.USER_PERMISSIONS for Alpine.js client-side gating
- P3: Add page-level permission guards on store routes
- P4: Role CRUD API endpoints and role editor UI
- P5: Audit trail for all role/permission changes

Includes unit tests (menu permission filtering, role CRUD service) and
integration tests (role API endpoints). All 404 core+tenancy tests pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/templates/store/base.html

@@ -62,6 +62,7 @@
             currency: '{{ storefront_currency }}',
             dashboardLanguage: '{{ dashboard_language }}'
         };
+        window.USER_PERMISSIONS = {{ user_permissions | default([]) | tojson }};
     </script>
 
     <!-- 2. SECOND: Icons (before Alpine.js) -->