feat: granular permissions, export backup, user/role management

- PermissionSeeder: 29 permissions with role mapping (admin/manager/staff)
- Policies updated to use hasPermissionTo() instead of hasRole()
- ExportBackup command: JSON per-table backup with chunk processing
- UserResource: CRUD users with role assignment (admin only)
- RoleResource: CRUD roles with permission assignment (admin only)
- UserPolicy + RolePolicy: admin-only access control
- ImportCskh: detailed skip logging with color in dry-run mode
- Widgets: permission-based visibility checks
- Tests: 8/8 pass (21 assertions)

PROGRESS.md

@@ -126,6 +126,17 @@ Tham chiếu: `SOP_des.md` — Bản đặc tả hệ thống After-Sale CRM
 ### Còn lại (Optional)
 - [ ] Auto-suggest chuyển phòng ban dựa trên loại hợp đồng (Ticket BCC → gợi ý Pháp lý)
 
+### Granular Permissions + Export Backup + User/Role Management
+- [x] PermissionSeeder: 29 permissions (view/create/update/delete per module + close-ticket, transfer-department, export-data)
+- [x] Role → Permission mapping: admin (all), manager (no delete/export), staff (view + limited write)
+- [x] Policies updated to use `hasPermissionTo()` instead of `hasRole()`
+- [x] Widgets/Filament updated to use permission-based checks
+- [x] ExportBackup command: `app:export-backup` (JSON, per-table, chunk 500, manifest.json)
+- [x] UserResource: admin can create/edit/delete users + assign roles
+- [x] RoleResource: admin can create/edit/delete roles + assign permissions
+- [x] UserPolicy + RolePolicy (admin-only)
+- [x] Tests updated: 8 tests, 21 assertions pass
+
 ---
 
 ## Database Schema (final — 23 migrations)