feat(rbac): enforce fine-grained console permissions

[yardbirds0]

Summary

• Add a backend-owned permission catalog, role CRUD, and global or device-group scoped user-role assignments.
• Enforce permissions server-side for users, user groups, devices, address books, strategies, and audit queries.
• Read administrator status from the current database state, protect super-administrator targets, and apply device scope before list pagination and object mutations.
• Persist privileged and denied authorization audit events.
• Scope legacy address-book peer-tag replacement to the current address book.

Security boundaries

• Role administration and device-group structure remain super-administrator only.
• Advanced scope is limited to device actions and strategies.assign.
• Address-book permissions continue to compose with existing ownership and sharing ACLs.
• This does not add remote-connection authorization and does not duplicate Strategy session controls.

API

• GET /api/permissions and GET /api/permissions/me
• /api/roles role CRUD and permission replacement
• GET|PUT /api/users/:guid/roles and role revocation
• Existing administrative routes now enforce their corresponding permission codes.

Verification

• npm test -- --runInBand (5 suites, 51 tests)
• npx tsc --noEmit
• npx eslint "{src,apps,libs,test}/**/*.ts"
• npm run build

Docker image build was not run because the local Docker Desktop engine is stopped.

[YuZhiYuanDev]

Since your Docker engine was stopped, I went ahead and ran the CI for you. The Docker build worked perfectly fine. Many thanks for your work!