Add Access group admin surfaces, booking soft deletes, refund crash fix

Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
  real .env keys via new EnvFileWriter (no parallel DB settings table, so
  BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings

Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
  ::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
  BookingsTable, using authorize() so the policy is enforced at call time,
  not just cosmetically hidden

Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
  RefundBookingAction's non-nullable Booking param — a soft-deleted
  booking's payment reaching the refund picker was an uncaught TypeError.
  Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
  pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.

289 tests passing.

app-modules/identity/src/Filament/Resources/Staff/Schemas/StaffForm.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace Modules\Identity\Filament\Resources\Staff\Schemas;
+
+use App\Models\User;
+use Filament\Forms\Components\Select;
+use Filament\Forms\Components\TextInput;
+use Filament\Schemas\Schema;
+use Illuminate\Support\Facades\Hash;
+
+class StaffForm
+{
+    public static function configure(Schema $schema): Schema
+    {
+        return $schema
+            ->components([
+                TextInput::make('name')
+                    ->required()
+                    ->maxLength(255),
+                TextInput::make('email')
+                    ->required()
+                    ->email()
+                    ->unique(ignoreRecord: true)
+                    ->maxLength(255),
+                TextInput::make('password')
+                    ->password()
+                    ->revealable()
+                    ->required(fn (string $operation) => $operation === 'create')
+                    ->minLength(8)
+                    ->dehydrateStateUsing(fn (?string $state) => filled($state) ? Hash::make($state) : null)
+                    ->dehydrated(fn (?string $state) => filled($state))
+                    ->helperText('Leave blank to keep the current password.'),
+                Select::make('roles')
+                    ->relationship(
+                        name: 'roles',
+                        titleAttribute: 'name',
+                        modifyQueryUsing: fn ($query) => $query->whereIn('name', User::ADMIN_TIER_ROLES),
+                    )
+                    ->multiple()
+                    ->preload()
+                    ->required()
+                    ->helperText('Determines whether this staff member can sign in here at all, and what they can do.'),
+            ]);
+    }
+}