- LoginController: admin tidak ditolak saat login kedua (multi-sesi boleh)
- Middleware SingleSession: admin tidak ditendang walau sesi ≠ token aktif
- Alasan: admin terkunci = tidak ada yang bisa Paksa Logout akun lain
- 2 test baru (login kedua admin diterima; middleware tidak menendang admin)
- Add permissions & role_permissions tables with migration
- Add PermissionMiddleware for route-level access control
- Add CheckRole middleware for role-based fallback
- Add PermissionController with UI (Settings > Hak Akses Role)
- Add @canPermission Blade directive for view-level checks
- Convert all routes to use dynamic permission middleware
- Add canPermission() method to User model
- All access rights configurable via admin UI