Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.

app-modules/booking/src/Policies/BookingPolicy.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Modules\Booking\Policies;
+
+use App\Models\User;
+
+/**
+ * Skeleton only — role/permission gates for now. Per-booking ownership
+ * checks (e.g. a customer may only view/cancel their own booking) are
+ * filled in against the real Booking model once it exists (Phase 4).
+ */
+class BookingPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can('view_bookings');
+    }
+
+    public function view(User $user, mixed $booking): bool
+    {
+        return $user->can('view_bookings');
+    }
+
+    public function create(User $user): bool
+    {
+        return true;
+    }
+
+    public function cancel(User $user, mixed $booking): bool
+    {
+        return $user->can('manage_bookings');
+    }
+
+    public function refund(User $user, mixed $booking): bool
+    {
+        return $user->can('process_refunds');
+    }
+}

app-modules/booking/src/Providers/BookingServiceProvider.php

@@ -2,11 +2,16 @@
 
 namespace Modules\Booking\Providers;
 
+use Illuminate\Contracts\Auth\Access\Gate;
 use Illuminate\Support\ServiceProvider;
+use Modules\Booking\Policies\BookingPolicy;
 
 class BookingServiceProvider extends ServiceProvider
 {
     public function register(): void {}
 
-    public function boot(): void {}
+    public function boot(Gate $gate): void
+    {
+        $gate->policy('Modules\Booking\Models\Booking', BookingPolicy::class);
+    }
 }

app-modules/booking/tests/Feature/BookingPolicyTest.php

@@ -0,0 +1,49 @@
+<?php
+
+use App\Models\User;
+use Modules\Booking\Policies\BookingPolicy;
+use Spatie\Permission\Models\Permission;
+
+beforeEach(function () {
+    foreach (['view_bookings', 'manage_bookings', 'process_refunds'] as $permission) {
+        Permission::findOrCreate($permission, 'web');
+    }
+});
+
+test('viewAny and view require the view_bookings permission', function () {
+    $policy = new BookingPolicy;
+
+    $withPermission = User::factory()->create()->givePermissionTo('view_bookings');
+    $withoutPermission = User::factory()->create();
+
+    expect($policy->viewAny($withPermission))->toBeTrue()
+        ->and($policy->view($withPermission, null))->toBeTrue()
+        ->and($policy->viewAny($withoutPermission))->toBeFalse()
+        ->and($policy->view($withoutPermission, null))->toBeFalse();
+});
+
+test('create is open to any authenticated user', function () {
+    $policy = new BookingPolicy;
+
+    expect($policy->create(User::factory()->create()))->toBeTrue();
+});
+
+test('cancel requires the manage_bookings permission', function () {
+    $policy = new BookingPolicy;
+
+    $withPermission = User::factory()->create()->givePermissionTo('manage_bookings');
+    $withoutPermission = User::factory()->create();
+
+    expect($policy->cancel($withPermission, null))->toBeTrue()
+        ->and($policy->cancel($withoutPermission, null))->toBeFalse();
+});
+
+test('refund requires the process_refunds permission', function () {
+    $policy = new BookingPolicy;
+
+    $withPermission = User::factory()->create()->givePermissionTo('process_refunds');
+    $withoutPermission = User::factory()->create();
+
+    expect($policy->refund($withPermission, null))->toBeTrue()
+        ->and($policy->refund($withoutPermission, null))->toBeFalse();
+});