feat: Add idempotent RolesAndPermissionsSeeder for RBAC Phase 4

[kevalyq]

🎯 Objective

Implement idempotent seeder for predefined roles and permissions (RBAC Phase 4).

📋 Changes

Seeder Implementation

• ✅ Created RolesAndPermissionsSeeder.php with idempotent firstOrCreate() pattern
• ✅ Added guard_name='sanctum' to all Permission and Role creation
• ✅ Added missing permissions.assign_direct and permissions.revoke_direct
• ✅ Registered seeder in DatabaseSeeder.php call chain

Predefined Roles (5)

• Admin: Full system access (37 permissions)
• Manager: Branch-scoped management (16 permissions)
• Guard: Own data + shift assignments (5 permissions)
• Client: Read-only location data (3 permissions)
• Works Council: BR-specific permissions (8 permissions)

Permission Groups (37 total)

• Employees (7): read, create, update, delete, read_salary, read_all_branches, export
• Shifts (6): read, create, update, delete, publish, approve_as_br
• Work Instructions (7): read, create, update, delete, publish, acknowledge, view_acknowledgments
• Roles (6): read, create, update, delete, assign_temporary, extend_expiration
• Permissions (6): read, create, update, delete, assign_direct, revoke_direct
• Works Council (2): access_employee_files, approve_shift_plans
• Reports (3): generate, view, export

Idempotency Testing

• ✅ Seeder runs 3+ times without duplicates
• ✅ Verified: Role::count() === 5
• ✅ Verified: Permission::count() === 37
• ✅ All roles use guard_name='sanctum'
• ✅ All permissions use guard_name='sanctum'

🧪 Quality Gates

• ✅ PHPStan Level Max: 0 errors
• ✅ Laravel Pint: Clean (0 files changed)
• ✅ REUSE 3.3: Compliant (164/164 files)
• ✅ Domain Policy: Passed (secpal.app/dev only)
• ✅ Markdownlint: 0 errors
• ✅ Tests: 233 passed in 19.86s

✅ Acceptance Criteria

• ✅ Seeder creates 5 predefined roles with correct permissions
• ✅ Seeder is idempotent (can run multiple times safely)
• ✅ Deleted predefined roles are recreated on next seeder run
• ✅ All permissions use guard_name='sanctum'
• ✅ All roles use guard_name='sanctum'
• ✅ No errors when running seeder repeatedly
• ✅ PHPStan + Pint clean

📊 Test Results

# Idempotency Test (3 runs)
ddev exec php artisan db:seed --class=RolesAndPermissionsSeeder  # ✓
ddev exec php artisan db:seed --class=RolesAndPermissionsSeeder  # ✓
ddev exec php artisan db:seed --class=RolesAndPermissionsSeeder  # ✓

# Verification
Role::count()       // 5
Permission::count() // 37

🔗 Related Issues

Fixes #139
Part of #108 - RBAC Phase 4

📝 Review Checklist

• ✅ Seeder uses firstOrCreate() everywhere
• ✅ Guard name explicit (sanctum) for all permissions
• ✅ Guard name explicit (sanctum) for all roles
• ✅ Permission naming follows resource.action convention
• ✅ All 5 predefined roles have correct permissions
• ✅ Tested running seeder 3+ times (no duplicates)
• ✅ PHPDoc explains idempotency

---

Type: Database / RBAC
Size: ~6 LOC changed
Risk: Low (data seeding, idempotent design)

[github-actions]

💡 Tip: Consider Using Draft PRs

Benefits of opening PRs as drafts initially:

• 💰 Saves CI runtime and Copilot review credits
• 🎯 Automatically sets linked issues to "🚧 In Progress" status
• 🚀 Mark "Ready for review" when done to trigger full CI pipeline

How to convert:

1. Click "Still in progress? Convert to draft" in the sidebar, OR
2. Use gh pr ready when ready for review

This is just a friendly reminder - feel free to continue as is! 😊

[Copilot]

Pull Request Overview

This PR implements an idempotent seeder for RBAC Phase 4, adding predefined roles and permissions with explicit Sanctum guard names. The key changes add guard_name='sanctum' to Role and Permission creation and introduce two new permission actions for direct permission management.

• Adds explicit guard_name='sanctum' to all Permission and Role creation calls
• Introduces permissions.assign_direct and permissions.revoke_direct actions
• Ensures idempotent seeder operation using firstOrCreate() pattern

[github-actions]

💡 Tip: Consider Using Draft PRs

Benefits of opening PRs as drafts initially:

• 💰 Saves CI runtime and Copilot review credits
• 🎯 Automatically sets linked issues to "🚧 In Progress" status
• 🚀 Mark "Ready for review" when done to trigger full CI pipeline

How to convert:

1. Click "Still in progress? Convert to draft" in the sidebar, OR
2. Use gh pr ready when ready for review

This is just a friendly reminder - feel free to continue as is! 😊