feat(04-01): InventoryService, API routes, migration, and 13 passing tests

- InventoryService: registerItem, recordMovement, getStockLevels, getItemMovements, listItems
- RECEIVED movements auto-post JE (DR 1200 Equipment Inventory, CR 2010 AP)
- Stock levels derived from movement aggregation (no mutable quantity column)
- All 5 movement types validated with type-specific rules
- API routes: POST/GET items, GET item detail, POST/GET movements, GET stock-levels
- CASL: OFFICE_STAFF gets manage Inventory permission
- Migration applied: add_inventory_models (4 enums, 2 tables)
- 13 tests: registration, all movement types, stock derivation, JE posting, history

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/lib/casl/permissions.ts

@@ -60,6 +60,8 @@ export function definePermissionsFor(
       // Technician profile management (read/update, not create — admin only for compensation config)
       can("read", "TechnicianProfile");
       can("update", "TechnicianProfile");
+      // Inventory management
+      can("manage", "Inventory");
       // Job type rates (read-only for office staff — admin configures rates)
       can("read", "JobTypeRate");
       // View financial reports (read-only)