feat: dynamic role-based permission system

- Add permissions & role_permissions tables with migration
- Add PermissionMiddleware for route-level access control
- Add CheckRole middleware for role-based fallback
- Add PermissionController with UI (Settings > Hak Akses Role)
- Add @canPermission Blade directive for view-level checks
- Convert all routes to use dynamic permission middleware
- Add canPermission() method to User model
- All access rights configurable via admin UI

app/Providers/AppServiceProvider.php

@@ -3,6 +3,8 @@
 namespace App\Providers;
 
 use Illuminate\Pagination\Paginator;
+use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -21,5 +23,24 @@ class AppServiceProvider extends ServiceProvider
     public function boot(): void
     {
         Paginator::defaultView('vendor.pagination.tailwind');
+
+        // Blade directive: @canPermission('sync-data')
+        Blade::if('canPermission', function (string $permission) {
+            $user = auth()->user();
+            if (! $user) {
+                return false;
+            }
+            if ($user->role === 'admin') {
+                return true;
+            }
+            $rolePermissions = Cache::remember('role_permissions:' . $user->role, 3600, function () use ($user) {
+                return \DB::table('role_permissions')
+                    ->join('permissions', 'role_permissions.permission_id', '=', 'permissions.id')
+                    ->where('role_permissions.role', $user->role)
+                    ->pluck('permissions.key')
+                    ->toArray();
+            });
+            return in_array($permission, $rolePermissions);
+        });
     }
 }