- Create src/lib/middleware/authorize.ts with withPermission() HOF
- Returns 401 for unauthenticated, 403 for unauthorized access
- Passes ability + user to authorized handlers for fine-grained checks
- Add authorize() convenience alias for handler-first usage pattern
- Create src/lib/__tests__/rbac.test.ts with 66 unit tests covering:
- Admin full access to all subjects
- Office Staff: can manage billing, blocked from Chart of Accounts
- Collector: can record payments, blocked from invoice management
- Technician: blocked from billing/payments (critical security boundary)
- Client: scoped to own data only
- Multi-role additive union (TECHNICIAN+COLLECTOR gets both sets)
- Super-admin bypasses all permission checks
- Fix CASL MongoAbility type: use createMongoAbility throughout
- Fix condition casting for string-based subjects (no Prisma models yet)
- Fix ability merging: cannot() rules excluded for multi-role union
