feat: granular permissions, export backup, user/role management

- PermissionSeeder: 29 permissions with role mapping (admin/manager/staff)
- Policies updated to use hasPermissionTo() instead of hasRole()
- ExportBackup command: JSON per-table backup with chunk processing
- UserResource: CRUD users with role assignment (admin only)
- RoleResource: CRUD roles with permission assignment (admin only)
- UserPolicy + RolePolicy: admin-only access control
- ImportCskh: detailed skip logging with color in dry-run mode
- Widgets: permission-based visibility checks
- Tests: 8/8 pass (21 assertions)

CODEBASE_SNAPSHOT.md

@@ -100,13 +100,34 @@ app/
 │   │       │   └── ProductForm.php
 │   │       └── Tables/
 │   │           └── ProductsTable.php
+│   │   └── Users/                                     # NEW
+│   │       ├── UserResource.php                       # Admin-only user management
+│   │       ├── Pages/
+│   │       │   ├── CreateUser.php
+│   │       │   ├── EditUser.php
+│   │       │   └── ListUsers.php                      # Tabs: All/Admin/Manager/Staff
+│   │       ├── Schemas/
+│   │       │   └── UserForm.php                       # name, email, password, role (dynamic)
+│   │       └── Tables/
+│   │           └── UsersTable.php                     # name, email, role badge
+│   │   └── Roles/                                     # NEW
+│   │       ├── RoleResource.php                       # Admin-only role management
+│   │       ├── Pages/
+│   │       │   ├── CreateRole.php
+│   │       │   ├── EditRole.php
+│   │       │   └── ListRoles.php
+│   │       ├── Schemas/
+│   │       │   └── RoleForm.php                       # name + permissions checkbox list
+│   │       └── Tables/
+│   │           └── RolesTable.php                     # name, permissions count, users count
 │   └── Widgets/
 │       ├── AvgProcessingTimeWidget.php       # 4 stats: resolved count, avg time, pending, escalated
 │       ├── HandlerPerformanceWidget.php      # bar chart: avg time per handler
 │       └── ResolvedTicketsWidget.php         # table: resolved tickets awaiting closure
 ├── Console/                                   # NEW
 │   └── Commands/
-│       └── ImportCskh.php                     # app:import-cskh command
+│       ├── ImportCskh.php                     # app:import-cskh command
+│       └── ExportBackup.php                   # app:export-backup command (JSON backup)
 ├── Enums/                                     # NEW
 │   ├── ContractType.php                       # SALE/LEASE/BCC
 │   ├── ContractStatus.php                     # ACTIVE/EXPIRED/LIQUIDATED
@@ -349,13 +370,17 @@ Relationships: `feedback()`, `fromDepartment()`, `toDepartment()`, `sender()`
 
 ## Policies — Tóm tắt
 
+> **Note:** Policies now use Spatie `hasPermissionTo()` instead of `hasRole()` for granular permission control.
+
 | Policy | viewAny/view | create | update | delete | restore/forceDelete |
 |--------|-------------|--------|--------|--------|---------------------|
-| ContractPolicy | all roles | admin+manager | admin+manager | admin | admin only |
-| FeedbackPolicy | all roles | all roles | all roles | admin+manager | admin only |
-| ProductPolicy | all roles | admin+manager | admin+manager | admin | admin only |
-| CustomerPolicy | all roles | admin+manager | admin+manager | admin | admin only |
-| FeedbackChannelPolicy | all roles | admin+manager | admin+manager | admin | admin only |
+| ContractPolicy | view-contract | create-contract | update-contract | delete-contract | admin only |
+| FeedbackPolicy | view-feedback | create-feedback | update-feedback | delete-feedback | admin only |
+| ProductPolicy | view-product | create-product | update-product | delete-product | admin only |
+| CustomerPolicy | view-customer | create-customer | update-customer | delete-customer | admin only |
+| FeedbackChannelPolicy | view-channel | create-channel | update-channel | delete-channel | admin only |
+| UserPolicy | admin only | admin only | admin only | admin only (not self) | admin only (not self) |
+| RolePolicy | admin only | admin only | admin only | admin only (not built-in) | admin only (not built-in) |
 
 ---
 
@@ -412,17 +437,22 @@ Dashboard (AccountWidget + 3 custom widgets)
 
 ---
 
-## Seeder (AfterSalesSeeder) — Data mẫu
+## Seeder (AfterSalesSeeder + PermissionSeeder) — Data mẫu
 
 - 3 users (admin, manager, staff) + Spatie roles
+- **29 granular permissions** (PermissionSeeder) — NEW
+  - Feedback: view/create/update/delete, add-interaction, close-ticket, transfer-department
+  - Products/Customers/Contracts/Channels/Tags: view/create/update/delete each
+  - Dashboard: view-dashboard-widgets, export-data
+- Role → Permission mapping: admin (all), manager (no delete/export), staff (view + limited write)
 - 4 departments (CSKH: manager quản lý, Kỹ thuật: admin quản lý, Kế toán, Pháp lý)
 - 5 feedback channels (Email, Zalo, Phone, Document, In Person)
 - 5 products (Sunrise A1, A2, Green Valley Villa, Ocean Tower, Park Hill)
 - 4 customers
 - 5 customer-product assignments
-- **5 contracts** (2 Sale, 2 Lease, 1 BCC) — NEW
-- **5 handovers** (2 Đã BG, 1 Đủ ĐK, 1 Đã lên lịch, 1 Chưa đủ ĐK) — NEW
-- **5 product_services** (2 Management Fee, 2 Gratitude, 1 Self Business) — NEW
+- **5 contracts** (2 Sale, 2 Lease, 1 BCC)
+- **5 handovers** (2 Đã BG, 1 Đủ ĐK, 1 Đã lên lịch, 1 Chưa đủ ĐK)
+- **5 product_services** (2 Management Fee, 2 Gratitude, 1 Self Business)
 - 5 feedbacks (pending: 2, processing: 1, resolved: 1, closed: 1)
 - 5 feedback tags
 - 5 feedback interactions