feat: enforce permission-aware service and admin access

[arapsum]

Summary

• expose each authenticated user's effective roles and permissions
• enforce permission-specific RBAC policies across protected service routes
• conditionally render admin navigation, actions, routes, and forbidden states
• expand authorization-boundary coverage in service and admin tests
• merge request and user-model fixture corrections for the current seeded identities and roles

Test fixes

• privileged request cases authenticate as the seeded administrator
• customer order cases explicitly establish ownership and permission state
• user model lookups, password operations, duplicate checks, and snapshots use current seeded emails
• seed-dependent checkout and role-permission snapshots were reviewed with cargo insta review

Verification

• cargo test --test mod requests -- --test-threads=1: 226 passed
• cargo test --test mod models::user -- --test-threads=1: 33 passed, 1 intentionally ignored
• cargo test --all-features --all -- --test-threads=1: 552 passed before two reviewed stale snapshots; both failing cases then passed directly
• cargo clippy --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery -W rust-2018-idioms
• cargo fmt --all -- --check
• pnpm run fmt
• pnpm run lint
• pnpm exec tsc --noEmit
• pnpm run build
• pnpm test: 12 passed
• git diff --check; no pending snapshot files