feat: implement complete RBAC access control with tests

Add 4-layer access control stack (subscription → module → menu → permissions):
- P1: Wire requires_permission into menu sidebar filtering
- P2: Expose window.USER_PERMISSIONS for Alpine.js client-side gating
- P3: Add page-level permission guards on store routes
- P4: Role CRUD API endpoints and role editor UI
- P5: Audit trail for all role/permission changes

Includes unit tests (menu permission filtering, role CRUD service) and
integration tests (role API endpoints). All 404 core+tenancy tests pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

mkdocs.yml

@@ -44,6 +44,7 @@ nav:
       - Observability: architecture/observability.md
       - Request Flow: architecture/request-flow.md
       - Authentication & RBAC: architecture/auth-rbac.md
+      - Access Control Stack: architecture/access-control-stack.md
       - UserContext Pattern: architecture/user-context-pattern.md
       - Frontend Structure: architecture/frontend-structure.md
       - Models Structure: architecture/models-structure.md
@@ -54,6 +55,7 @@ nav:
         - Migration Status: architecture/api-migration-status.md
       - Audit Provider Pattern: architecture/audit-provider-pattern.md
       - Cross-Module Import Rules: architecture/cross-module-import-rules.md
+      - Cross-Module Migration Plan: architecture/cross-module-migration-plan.md
       - Customer Orders Architecture: architecture/customer-orders-architecture.md
       - Frontend Detection: architecture/frontend-detection.md
       - Media Architecture: architecture/media-architecture.md