feat: granular permissions, export backup, user/role management

- PermissionSeeder: 29 permissions with role mapping (admin/manager/staff)
- Policies updated to use hasPermissionTo() instead of hasRole()
- ExportBackup command: JSON per-table backup with chunk processing
- UserResource: CRUD users with role assignment (admin only)
- RoleResource: CRUD roles with permission assignment (admin only)
- UserPolicy + RolePolicy: admin-only access control
- ImportCskh: detailed skip logging with color in dry-run mode
- Widgets: permission-based visibility checks
- Tests: 8/8 pass (21 assertions)

TASKS_ROADMAP.md

@@ -53,6 +53,14 @@
 - [x] Docker deployment
 - [x] Migration notifications table
 
+### Giai đoạn 9: Granular Permissions + Export Backup + User/Role Management
+- [x] PermissionSeeder: 29 granular permissions (admin/manager/staff mapping)
+- [x] Policies updated to `hasPermissionTo()` (5 policies)
+- [x] ExportBackup command: `app:export-backup` (JSON, per-table, chunk 500)
+- [x] UserResource: CRUD users + assign role (admin only)
+- [x] RoleResource: CRUD roles + assign permissions via CheckboxList (admin only)
+- [x] UserPolicy + RolePolicy (admin-only access)
+
 ---
 
 ## 🔴 CHƯA LÀM — Theo AI Instructions