feat: granular permissions, export backup, user/role management

- PermissionSeeder: 29 permissions with role mapping (admin/manager/staff)
- Policies updated to use hasPermissionTo() instead of hasRole()
- ExportBackup command: JSON per-table backup with chunk processing
- UserResource: CRUD users with role assignment (admin only)
- RoleResource: CRUD roles with permission assignment (admin only)
- UserPolicy + RolePolicy: admin-only access control
- ImportCskh: detailed skip logging with color in dry-run mode
- Widgets: permission-based visibility checks
- Tests: 8/8 pass (21 assertions)

app/Filament/Resources/Users/Pages/ListUsers.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Filament\Resources\Users\Pages;
+
+use App\Filament\Resources\Users\UserResource;
+use Filament\Actions;
+use Filament\Resources\Pages\ListRecords;
+use Filament\Schemas\Components\Tabs\Tab;
+use Illuminate\Database\Eloquent\Builder;
+
+class ListUsers extends ListRecords
+{
+    protected static string $resource = UserResource::class;
+
+    protected function getHeaderActions(): array
+    {
+        return [
+            Actions\CreateAction::make(),
+        ];
+    }
+
+    public function getTabs(): array
+    {
+        return [
+            'all' => Tab::make(),
+            'admin' => Tab::make()
+                ->modifyQueryUsing(fn (Builder $query) => $query->where('role', 'admin'))
+                ->badge(fn () => static::getResource()::getModel()::where('role', 'admin')->count()),
+            'manager' => Tab::make()
+                ->modifyQueryUsing(fn (Builder $query) => $query->where('role', 'manager'))
+                ->badge(fn () => static::getResource()::getModel()::where('role', 'manager')->count()),
+            'staff' => Tab::make()
+                ->modifyQueryUsing(fn (Builder $query) => $query->where('role', 'staff'))
+                ->badge(fn () => static::getResource()::getModel()::where('role', 'staff')->count()),
+        ];
+    }
+}