feat: add RBAC + ABAC permission system for admin cabinet

Backend:
- 4 new models: AdminRole, UserRole, AccessPolicy, AdminAuditLog
- Permission engine with RBAC wildcard matching + ABAC policy evaluation
- 26 permission sections (78 unique permissions) covering all admin routes
- require_permission() FastAPI dependency for route-level access control
- JWT tokens carry permissions, roles, role_level for frontend checks
- Admin roles CRUD with level-based hierarchy (viewers → superadmin)
- ABAC policies with time ranges and IP whitelist conditions
- Full audit log with CSV export
- Bootstrap service seeds 5 preset roles and assigns superadmins at startup
- Alembic migration 0011 for all RBAC tables

main.py

@@ -217,6 +217,21 @@ async def main():
             if not token_ok:
                 stage.warning('Не удалось создать/проверить дефолтный веб-API токен')
 
+        async with timeline.stage(
+            'RBAC bootstrap',
+            '🔐',
+            success_message='RBAC roles and superadmins ready',
+        ) as stage:
+            try:
+                from app.database.database import AsyncSessionLocal
+                from app.services.rbac_bootstrap_service import bootstrap_superadmins
+
+                async with AsyncSessionLocal() as db:
+                    await bootstrap_superadmins(db)
+            except Exception as error:
+                stage.warning(f'RBAC bootstrap warning: {error}')
+                logger.error('RBAC bootstrap failed', error=error)
+
         async with timeline.stage(
             'Синхронизация тарифов из конфига',
             '💰',