Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.

app-modules/routing/tests/Feature/RoutePolicyTest.php

@@ -0,0 +1,28 @@
+<?php
+
+use App\Models\User;
+use Modules\Routing\Policies\RoutePolicy;
+use Spatie\Permission\Models\Permission;
+
+beforeEach(function () {
+    Permission::findOrCreate('manage_routes', 'web');
+});
+
+test('every gate requires the manage_routes permission', function (string $method) {
+    $policy = new RoutePolicy;
+
+    $withPermission = User::factory()->create()->givePermissionTo('manage_routes');
+    $withoutPermission = User::factory()->create();
+
+    $args = $method === 'viewAny' || $method === 'create'
+        ? [$withPermission]
+        : [$withPermission, null];
+
+    expect($policy->{$method}(...$args))->toBeTrue();
+
+    $args = $method === 'viewAny' || $method === 'create'
+        ? [$withoutPermission]
+        : [$withoutPermission, null];
+
+    expect($policy->{$method}(...$args))->toBeFalse();
+})->with(['viewAny', 'create', 'update', 'delete']);