Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.

app-modules/identity/database/seeders/RolePermissionSeeder.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace Modules\Identity\Database\Seeders;
+
+use Illuminate\Database\Seeder;
+use Spatie\Permission\Models\Permission;
+use Spatie\Permission\Models\Role;
+use Spatie\Permission\PermissionRegistrar;
+
+class RolePermissionSeeder extends Seeder
+{
+    /**
+     * @var list<string>
+     */
+    protected array $permissions = [
+        'manage_catalog',
+        'manage_routes',
+        'manage_pricing',
+        'view_bookings',
+        'manage_bookings',
+        'view_payments',
+        'process_refunds',
+        'view_audit_log',
+    ];
+
+    /**
+     * @var array<string, list<string>>
+     */
+    protected array $roles = [
+        'super_admin' => [
+            'manage_catalog',
+            'manage_routes',
+            'manage_pricing',
+            'view_bookings',
+            'manage_bookings',
+            'view_payments',
+            'process_refunds',
+            'view_audit_log',
+        ],
+        'admin' => [
+            'manage_catalog',
+            'manage_routes',
+            'manage_pricing',
+            'view_bookings',
+            'manage_bookings',
+            'view_payments',
+            'process_refunds',
+            'view_audit_log',
+        ],
+        'support' => [
+            'view_bookings',
+            'view_payments',
+            'view_audit_log',
+        ],
+    ];
+
+    public function run(): void
+    {
+        foreach ($this->permissions as $permission) {
+            Permission::findOrCreate($permission, 'web');
+        }
+
+        // WithoutModelEvents (used by DatabaseSeeder) suppresses the model
+        // events Spatie's permission cache relies on to invalidate itself,
+        // so the freshly created permissions above must be flushed manually.
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+
+        foreach ($this->roles as $role => $permissions) {
+            Role::findOrCreate($role, 'web')->syncPermissions($permissions);
+        }
+    }
+}