Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.

app-modules/routing/src/Policies/RoutePolicy.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Modules\Routing\Policies;
+
+use App\Models\User;
+
+/**
+ * Skeleton only — the EvRoute model doesn't exist yet (Phase 3). Gates on
+ * the manage_routes permission; catalog/route mutation is staff-only.
+ */
+class RoutePolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->can('manage_routes');
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->can('manage_routes');
+    }
+
+    public function update(User $user, mixed $route): bool
+    {
+        return $user->can('manage_routes');
+    }
+
+    public function delete(User $user, mixed $route): bool
+    {
+        return $user->can('manage_routes');
+    }
+}

app-modules/routing/src/Providers/RoutingServiceProvider.php

@@ -2,11 +2,16 @@
 
 namespace Modules\Routing\Providers;
 
+use Illuminate\Contracts\Auth\Access\Gate;
 use Illuminate\Support\ServiceProvider;
+use Modules\Routing\Policies\RoutePolicy;
 
 class RoutingServiceProvider extends ServiceProvider
 {
     public function register(): void {}
 
-    public function boot(): void {}
+    public function boot(Gate $gate): void
+    {
+        $gate->policy('Modules\Routing\Models\EvRoute', RoutePolicy::class);
+    }
 }