feat(01-04): CASL permission definitions and ability factory

- Install @casl/ability for role-based access control
- Create src/lib/casl/types.ts with AppAbility, AppSubjects, AppActions types
- Create src/lib/casl/permissions.ts with permission matrix for all 5 roles
- Create src/lib/casl/ability.ts with defineAbilityFor() factory function
- Support multi-role users via additive union of permissions
- Super-admin bypasses all permission checks via can("manage", "all")

package.json

@@ -18,6 +18,7 @@
     "seed": "npx tsx prisma/seed.ts"
   },
   "dependencies": {
+    "@casl/ability": "^6.8.0",
     "@prisma/client": "^6.19.2",
     "bcryptjs": "^3.0.3",
     "next": "16.1.6",