Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.

app-modules/identity/tests/Feature/EnsureFastApiAgentTest.php

@@ -0,0 +1,41 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Support\Facades\Route;
+use Modules\Identity\Enums\TokenAbility;
+
+beforeEach(function () {
+    Route::middleware(['auth:sanctum', 'fastapi.agent'])
+        ->get('/__test/fastapi-agent-only', fn () => response()->json(['ok' => true]));
+});
+
+test('a token scoped to exactly the agent abilities is allowed through', function () {
+    $agent = User::factory()->create();
+    $token = $agent->createToken('fastapi-agent', TokenAbility::fastApiAgentAbilities())->plainTextToken;
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/fastapi-agent-only')
+        ->assertSuccessful();
+});
+
+test('a customer token carrying broader abilities is rejected', function () {
+    $customer = User::factory()->create();
+    $token = $customer->createToken('iphone', TokenAbility::customerAbilities())->plainTextToken;
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/fastapi-agent-only')
+        ->assertForbidden();
+});
+
+test('a token missing one of the agent abilities is rejected', function () {
+    $user = User::factory()->create();
+    $token = $user->createToken('partial', [TokenAbility::RouteRead->value, TokenAbility::BookingCreate->value])->plainTextToken;
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/fastapi-agent-only')
+        ->assertForbidden();
+});
+
+test('an unauthenticated request is rejected', function () {
+    $this->getJson('/__test/fastapi-agent-only')->assertUnauthorized();
+});

app-modules/identity/tests/Feature/TokenIssuanceTest.php

@@ -0,0 +1,46 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Support\Facades\Hash;
+use Modules\Identity\Enums\TokenAbility;
+
+test('customer token endpoint issues a token with the full customer ability set', function () {
+    $user = User::factory()->create([
+        'password' => Hash::make('secret-password'),
+    ]);
+
+    $response = $this->postJson('/api/v1/auth/token', [
+        'email' => $user->email,
+        'password' => 'secret-password',
+        'device_name' => 'iphone',
+    ]);
+
+    $response->assertSuccessful()->assertJsonStructure(['token']);
+
+    $accessToken = $user->tokens()->sole();
+    expect($accessToken->abilities)->toEqualCanonicalizing(TokenAbility::customerAbilities());
+});
+
+test('customer token endpoint rejects invalid credentials', function () {
+    $user = User::factory()->create([
+        'password' => Hash::make('secret-password'),
+    ]);
+
+    $response = $this->postJson('/api/v1/auth/token', [
+        'email' => $user->email,
+        'password' => 'wrong-password',
+        'device_name' => 'iphone',
+    ]);
+
+    $response->assertUnprocessable();
+    expect($user->tokens()->count())->toBe(0);
+});
+
+test('identity:issue-agent-token command provisions a token scoped to the agent ability set', function () {
+    $this->artisan('identity:issue-agent-token')->assertSuccessful();
+
+    $agent = User::where('email', 'fastapi-agent@system.internal')->sole();
+    $token = $agent->tokens()->sole();
+
+    expect($token->abilities)->toEqualCanonicalizing(TokenAbility::fastApiAgentAbilities());
+});