Add Phase 1 Identity & Access module (roles, tokens, panel auth, policies)

Implements T1.1-T1.4: Spatie role/permission seeding, Sanctum token
issuance for customer channels and the FastAPI agent (with an
ability-exact-match middleware to tell them apart), Filament admin
panel access restricted to admin-tier roles with the navigation group
order, and skeleton BookingPolicy/RoutePolicy gated on the seeded
permissions ahead of their models landing in later phases.

tests/Feature/AdminPanelAccessTest.php

@@ -0,0 +1,19 @@
+<?php
+
+use App\Models\User;
+use Spatie\Permission\Models\Role;
+
+test('a user with an admin-tier role can access the admin panel', function (string $role) {
+    Role::findOrCreate($role, 'web');
+
+    $user = User::factory()->create();
+    $user->assignRole($role);
+
+    $this->actingAs($user)->get('/admin')->assertSuccessful();
+})->with(['super_admin', 'admin', 'support']);
+
+test('a user without an admin-tier role cannot access the admin panel', function () {
+    $user = User::factory()->create();
+
+    $this->actingAs($user)->get('/admin')->assertForbidden();
+});

tests/Pest.php

@@ -1,5 +1,8 @@
 <?php
 
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
 /*
 |--------------------------------------------------------------------------
 | Test Case
@@ -11,10 +14,14 @@
 |
 */
 
-pest()->extend(Tests\TestCase::class)
- // ->use(Illuminate\Foundation\Testing\RefreshDatabase::class)
+pest()->extend(TestCase::class)
+    ->use(RefreshDatabase::class)
     ->in('Feature');
 
+pest()->extend(TestCase::class)
+    ->use(RefreshDatabase::class)
+    ->in('../app-modules/*/tests/Feature');
+
 /*
 |--------------------------------------------------------------------------
 | Expectations