Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.

app-modules/identity/tests/Feature/EnsureFastApiAgentTest.php

@@ -0,0 +1,41 @@
+<?php
+
+use App\Models\User;
+use Illuminate\Support\Facades\Route;
+use Modules\Identity\Enums\TokenAbility;
+
+beforeEach(function () {
+    Route::middleware(['auth:sanctum', 'fastapi.agent'])
+        ->get('/__test/fastapi-agent-only', fn () => response()->json(['ok' => true]));
+});
+
+test('a token scoped to exactly the agent abilities is allowed through', function () {
+    $agent = User::factory()->create();
+    $token = $agent->createToken('fastapi-agent', TokenAbility::fastApiAgentAbilities())->plainTextToken;
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/fastapi-agent-only')
+        ->assertSuccessful();
+});
+
+test('a customer token carrying broader abilities is rejected', function () {
+    $customer = User::factory()->create();
+    $token = $customer->createToken('iphone', TokenAbility::customerAbilities())->plainTextToken;
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/fastapi-agent-only')
+        ->assertForbidden();
+});
+
+test('a token missing one of the agent abilities is rejected', function () {
+    $user = User::factory()->create();
+    $token = $user->createToken('partial', [TokenAbility::RouteRead->value, TokenAbility::BookingCreate->value])->plainTextToken;
+
+    $this->withHeader('Authorization', "Bearer {$token}")
+        ->getJson('/__test/fastapi-agent-only')
+        ->assertForbidden();
+});
+
+test('an unauthenticated request is rejected', function () {
+    $this->getJson('/__test/fastapi-agent-only')->assertUnauthorized();
+});