feat: full role permissions system — new modules, API persistence, sidebar context

- Backend: migration 080_role_permissions table (hotel-scoped, upsert)
- Backend: routes GET/PUT/DELETE /api/hotels/:slug/role-permissions
- Frontend: RolePermissionsContext — loads saved perms from API, provides can()
- Frontend: Sidebar uses context can() instead of hardcoded ROLE_PERMS
- Frontend: fixed module ID→permKey mapping (room-service, olap-reports, website-builder)
- Frontend: Documents page added to Управление nav (was missing)
- Frontend: equipment/wifi/ttlock get own permission keys (not bundled under 'settings')
- Frontend: floor_map gets own permission key (not bundled under 'rooms')
- Frontend: new module group 'Технологии': wifi, equipment, ttlock, floor_map
- Frontend: 'schedule' added to Администрирование module group
- Updated INITIAL_ROLE_PERMISSIONS: receptionist+availability+reports+documents+website, accountant+documents, technician+floor_map+equipment+ttlock

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/api.ts

@@ -302,6 +302,22 @@ export const api = {
       req<void>('DELETE', `/api/hotels/${slug}/users/${id}`),
   },
 
+  // ── Role Permissions ──────────────────────────────────────────────────────
+  rolePermissions: {
+    list: (slug: string) =>
+      req<import('../contexts/RolePermissionsContext').SavedRolePermission[]>(
+        'GET', `/api/hotels/${slug}/role-permissions`),
+
+    save: (slug: string, roleKey: string, data: {
+      name: string; color: string; isSystem: boolean; permissions: Record<string, boolean>
+    }) =>
+      req<import('../contexts/RolePermissionsContext').SavedRolePermission>(
+        'PUT', `/api/hotels/${slug}/role-permissions/${roleKey}`, data),
+
+    delete: (slug: string, roleKey: string) =>
+      req<void>('DELETE', `/api/hotels/${slug}/role-permissions/${roleKey}`),
+  },
+
   // ── Schedule ──────────────────────────────────────────────────────────────
   schedule: {
     list: (slug: string, from: string, to: string) =>