feat: RBAC catalog + 2FA UX (P0 blocker from /tmp/service/new/01-TZ)

Implements the RBAC TZ in app/Auth/Permissions.php with a 51-permission
catalog spanning 9 modules (clients/vehicles/work_orders/finance/salaries/
inventory/suppliers/admin/ai_assistant+analytics). All slugs are constants,
not magic strings — refactors against renames stay safe.

== 7 system roles ==
owner / admin / manager / accountant / receptionist / mechanic / viewer
Each gets a curated role-permission matrix per the TZ section 2.4:
- owner + admin: all 51
- manager: 23 (operations + reporting, no destructive finance/users)
- accountant: 17 (full finance/salaries, view-only WOs, no admin)
- receptionist: 13 (front-desk: clients/vehicles/WOs/payment-create)
- mechanic: 4 (own WOs + inventory view + own salary)
- viewer: 6 (read-only everything except finance/salaries)

== Seeder ==
App\Services\RbacSeeder:
- seedPermissions() creates the 51 Permission rows globally (idempotent)
- seedTenantRoles($companyId) sets the team context, creates the 7 Role
  rows scoped to that tenant, and syncPermissions per matrix
- syncUsersToRoles($companyId) maps legacy users.role string column to
  the new Spatie role assignment (parts_manager→manager, master→mechanic,
  marketer→manager, user→viewer)

== Migration ==
2026_06_04_000003 loops over all existing Companies and runs the seeder.
On a fresh prod deploy, every tenant gets the full RBAC catalog wired up
automatically. CompanyProvisioner::provision() also calls the seeder for
new tenants going forward.

== Resource gates ==
canViewAny / canCreate / canDelete on:
- PaymentResource (FINANCE_VIEW_OVERVIEW / FINANCE_CREATE_PAYMENT / FINANCE_DELETE_PAYMENT)
- ExpenseResource (FINANCE_VIEW_OVERVIEW / FINANCE_CREATE_EXPENSE / FINANCE_DELETE_PAYMENT)
- PayrollAdjustmentResource (SALARIES_VIEW_ALL / SALARIES_CALCULATE)
- PayrollRunResource (SALARIES_VIEW_ALL / SALARIES_CALCULATE)
- UserResource (ADMIN_USERS_VIEW / ADMIN_USERS_MANAGE)
- RoleResource (ADMIN_ROLES_MANAGE)

Mechanic sees only own WOs + inventory + own salary. Accountant sees all
finance but not admin. Receptionist sees clients/WOs but not finance
overview. Etc.

== User helpers ==
$user->canDo(Permissions::WORK_ORDERS_CREATE) — admin gets a bypass to
prevent lockouts from misconfigured permission grants.
$user->isOwner() / isAccountant() / isMechanic() — role shortcuts.
$user->hasTwoFactorEnabled() — true when app_authentication_secret is set.

== 2FA ==
Filament 5's native MultiFactorAuthentication (App + Email) is already
enabled in both TenantPanelProvider and CentralPanelProvider — confirmed.
The User model already implements HasAppAuthentication +
HasAppAuthenticationRecovery + HasEmailAuthentication.

This commit adds UX around it:
- UserResource list column: 2FA badge (green ✓ when enabled, amber ⚠ when off)
- UserResource form: "Securitate" section shows enabled/disabled + last_login_at
- New admin action "Resetează 2FA" with confirmation modal — clears
  app_authentication_secret + recovery codes for locked-out users

== Roles management UI ==
New /app/roles RoleResource:
- List: role label + slug + permission count + user count
- Edit: 10 grouped checkbox lists (per module) for fine-grained
  permission assignment + bulk-toggle per group
- System roles (owner/admin/etc.) have slug locked, can't be deleted
- Custom tenant-specific roles can be added on top
- Gated behind ADMIN_ROLES_MANAGE

== UserResource extension ==
- Role select now uses Permissions::roleLabels() (owner/admin/manager/...)
- New "Roluri suplimentare" multi-select for stacking roles on top of
  the primary one (permissions cumulate)
- afterSave syncs the picked roles + ensures primary role is always
  included

== Tests ==
RbacTest covers: 51 permissions seeded, 7 roles per tenant, owner has
all, mechanic has minimal, accountant has finance but not admin,
canDo returns true when role has permission, admin bypass, owner helper,
syncUsersToRoles legacy mapping (parts_manager→manager, master→mechanic,
user→viewer), 2FA helper round-trip.

Suite: 206 passed (576 assertions). Was 196.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/Filament/Tenant/Resources/UserResource.php

@@ -31,8 +31,17 @@ class UserResource extends Resource
 
     public static function canViewAny(): bool
     {
-        $u = auth()->user();
-        return $u && $u->role === 'admin';
+        return auth()->user()?->canDo(\App\Auth\Permissions::ADMIN_USERS_VIEW) ?? false;
+    }
+
+    public static function canCreate(): bool
+    {
+        return auth()->user()?->canDo(\App\Auth\Permissions::ADMIN_USERS_MANAGE) ?? false;
+    }
+
+    public static function canDelete($record): bool
+    {
+        return auth()->user()?->canDo(\App\Auth\Permissions::ADMIN_USERS_MANAGE) ?? false;
     }
 
     public static function form(Schema $schema): Schema
@@ -53,17 +62,10 @@ class UserResource extends Resource
                 ->schema([
                     Forms\Components\Select::make('role')
                         ->label('Rol primar')
-                        ->options([
-                            'admin' => 'Administrator',
-                            'manager' => 'Manager',
-                            'receptionist' => 'Recepție',
-                            'mechanic' => 'Mecanic',
-                            'parts_manager' => 'Magazioner piese',
-                            'accountant' => 'Contabil',
-                            'marketer' => 'Marketing',
-                        ])
+                        ->options(\App\Auth\Permissions::roleLabels())
                         ->required()
-                        ->default('mechanic'),
+                        ->default('mechanic')
+                        ->helperText('Rolul principal — sincronizat automat cu drepturile RBAC.'),
                     Forms\Components\Select::make('status')
                         ->options(['active' => 'Activ', 'inactive' => 'Inactiv', 'blocked' => 'Blocat'])
                         ->default('active')
@@ -76,6 +78,26 @@ class UserResource extends Resource
                         ->dehydrateStateUsing(fn ($state) => Hash::make($state))
                         ->minLength(6)
                         ->helperText('La editare lasă gol pentru a păstra parola actuală.'),
+                    Forms\Components\Select::make('roles_picked')
+                        ->label('Roluri suplimentare')
+                        ->multiple()
+                        ->options(\App\Auth\Permissions::roleLabels())
+                        ->afterStateHydrated(function ($component, $record) {
+                            if ($record) $component->state($record->roles->pluck('name')->all());
+                        })
+                        ->dehydrated(false)
+                        ->columnSpanFull()
+                        ->helperText('Roluri suplimentare peste rolul primar — drepturile se cumulează.'),
+                ]),
+            Schemas\Components\Section::make('Securitate')
+                ->columns(2)
+                ->schema([
+                    Forms\Components\Placeholder::make('mfa_status')
+                        ->label('Autentificare 2FA')
+                        ->content(fn ($record) => $record && $record->hasTwoFactorEnabled() ? '✓ Activat (TOTP)' : '✗ Dezactivat'),
+                    Forms\Components\Placeholder::make('last_login')
+                        ->label('Ultima autentificare')
+                        ->content(fn ($record) => $record?->last_login_at?->diffForHumans() ?? '—'),
                 ]),
         ]);
     }
@@ -87,7 +109,17 @@ class UserResource extends Resource
                 Tables\Columns\TextColumn::make('name')->searchable()->sortable(),
                 Tables\Columns\TextColumn::make('email')->searchable()->copyable(),
                 Tables\Columns\TextColumn::make('phone')->placeholder('—'),
-                Tables\Columns\TextColumn::make('role')->badge(),
+                Tables\Columns\TextColumn::make('role')
+                    ->formatStateUsing(fn ($state) => \App\Auth\Permissions::roleLabels()[$state] ?? $state)
+                    ->badge(),
+                Tables\Columns\IconColumn::make('app_authentication_secret')
+                    ->label('2FA')
+                    ->boolean()
+                    ->getStateUsing(fn ($record) => $record->hasTwoFactorEnabled())
+                    ->trueIcon('heroicon-o-shield-check')
+                    ->trueColor('success')
+                    ->falseIcon('heroicon-o-shield-exclamation')
+                    ->falseColor('warning'),
                 Tables\Columns\TextColumn::make('status')
                     ->badge()
                     ->colors([
@@ -109,6 +141,18 @@ class UserResource extends Resource
             ])
             ->actions([
                 Actions\EditAction::make(),
+                Actions\Action::make('reset_2fa')
+                    ->label('Resetează 2FA')
+                    ->icon('heroicon-o-shield-exclamation')
+                    ->color('warning')
+                    ->visible(fn ($record) => $record && $record->hasTwoFactorEnabled())
+                    ->requiresConfirmation()
+                    ->modalDescription('Dezactivează 2FA pentru acest utilizator. Va trebui să re-configureze TOTP la următoarea autentificare.')
+                    ->action(function ($record) {
+                        $record->saveAppAuthenticationSecret(null);
+                        $record->saveAppAuthenticationRecoveryCodes(null);
+                        \Filament\Notifications\Notification::make()->title('2FA resetat')->success()->send();
+                    }),
                 Actions\DeleteAction::make(),
             ])
             ->defaultSort('created_at', 'desc');