fix: add route-level authorization middleware to Phase 4 RBAC endpoints

[kevalyq]

Summary

Added route-level authorization middleware to Phase 4 RBAC endpoints (Role Management, Permission Management, and User Direct Permission Assignment).

Changes

• Role Management API (5 routes): Added permission middleware for roles.read, roles.create, roles.update, roles.delete
• Permission Management API (5 routes): Added permission middleware for permissions.read, permissions.create, permissions.update, permissions.delete
• User Direct Permission Assignment (2 write routes): Added permission middleware for permissions.assign_direct and permissions.revoke_direct
• User Permission View routes (2 read routes): Kept Policy-based authorization only (users can view own permissions without requiring permissions.read permission)

Authorization Architecture

• Write operations: Route middleware (early rejection) + Policy (business logic) = Defense-in-depth
• Read operations: Policy-based only for view-own routes (users can see their own permissions)
• Admin operations: Full middleware + Policy protection

Tests

• ✅ All 277 tests passing (1 skipped)
• Fixed UserPermissionAssignmentApiTest.php to include required permissions in Admin role setup
• RoleManagementApiTest.php and PermissionManagementApiTest.php already grant permissions per-test

Fixes #161

[github-actions]

💡 Tip: Consider Using Draft PRs

Benefits of opening PRs as drafts initially:

• 💰 Saves CI runtime and Copilot review credits
• 🎯 Automatically sets linked issues to "🚧 In Progress" status
• 🚀 Mark "Ready for review" when done to trigger full CI pipeline

How to convert:

1. Click "Still in progress? Convert to draft" in the sidebar, OR
2. Use gh pr ready when ready for review

This is just a friendly reminder - feel free to continue as is! 😊