Add Access group admin surfaces, booking soft deletes, refund crash fix

Access group (Filament):
- StaffResource: manage users with an admin-tier role, gated by manage_staff
- CustomerResource: read-only view of role-less users, gated by view_customers
- RoleResource: edit permissions per role (fixed role set), gated by manage_roles
- ManageAppSettings: tabbed General/Booking settings page that reads/writes
  real .env keys via new EnvFileWriter (no parallel DB settings table, so
  BookingService/config('booking.*') stay unchanged)
- Moved Access above Catalog in the nav group order
- New permissions: manage_staff, manage_roles, view_customers, manage_settings

Booking soft deletes:
- bookings.deleted_at + SoftDeletes on the Booking model
- BookingPolicy::delete (manage_bookings, cancelled/expired only) and
  ::restore (manage_bookings)
- DeleteBookingTableAction/RestoreBookingTableAction + TrashedFilter on
  BookingsTable, using authorize() so the policy is enforced at call time,
  not just cosmetically hidden

Refund crash fix:
- ProcessRefundAction passed a nullable $payment->booking into
  RefundBookingAction's non-nullable Booking param — a soft-deleted
  booking's payment reaching the refund picker was an uncaught TypeError.
  Excluded such payments from the picker and added a defensive guard.
- Same unguarded $event->payment->booking / $event->refund->payment->booking
  pattern fixed in the MarkBookingPaid/MarkBookingRefunded queued listeners.

289 tests passing.

app-modules/shared/tests/Unit/EnvFileWriterTest.php

@@ -0,0 +1,60 @@
+<?php
+
+use Modules\Shared\Support\EnvFileWriter;
+
+beforeEach(function () {
+    $this->path = sys_get_temp_dir().'/env-file-writer-test-'.uniqid().'.env';
+});
+
+afterEach(function () {
+    @unlink($this->path);
+});
+
+test('it replaces an existing key in place without touching other lines', function () {
+    file_put_contents($this->path, "APP_NAME=Laravel\nAPP_ENV=local\n");
+
+    (new EnvFileWriter($this->path))->write(['APP_NAME' => 'New Name']);
+
+    expect(file_get_contents($this->path))->toBe("APP_NAME=\"New Name\"\nAPP_ENV=local\n");
+});
+
+test('it appends a missing key at the end of the file', function () {
+    file_put_contents($this->path, "APP_NAME=Laravel\n");
+
+    (new EnvFileWriter($this->path))->write(['SUPPORT_EMAIL' => 'support@example.com']);
+
+    expect(file_get_contents($this->path))->toBe("APP_NAME=Laravel\nSUPPORT_EMAIL=support@example.com\n");
+});
+
+test('it formats booleans as bare true/false', function () {
+    file_put_contents($this->path, '');
+
+    (new EnvFileWriter($this->path))->write(['BOOKING_BACK_SEAT_ENABLED' => false]);
+
+    expect(file_get_contents($this->path))->toContain('BOOKING_BACK_SEAT_ENABLED=false');
+});
+
+test('it quotes values containing whitespace', function () {
+    file_put_contents($this->path, '');
+
+    (new EnvFileWriter($this->path))->write(['APP_NAME' => 'My Company']);
+
+    expect(file_get_contents($this->path))->toContain('APP_NAME="My Company"');
+});
+
+test('it writes multiple keys in one call', function () {
+    file_put_contents($this->path, "APP_NAME=Laravel\n");
+
+    (new EnvFileWriter($this->path))->write([
+        'APP_NAME' => 'Renamed',
+        'APP_CURRENCY' => 'MMK',
+        'BOOKING_FRONT_SEAT_MAX_PER_BOOKING' => 2,
+    ]);
+
+    $contents = file_get_contents($this->path);
+
+    expect($contents)
+        ->toContain('APP_NAME=Renamed')
+        ->toContain('APP_CURRENCY=MMK')
+        ->toContain('BOOKING_FRONT_SEAT_MAX_PER_BOOKING=2');
+});