fix(permissions): restore admin access after page reload

- /api/auth/me now returns app-role permissions (was empty after reload).
- client hasPermission/hasAnyPermission now bypass admin so UI queries are not disabled when permissions array is stale.

client/src/lib/permissions.ts

@@ -1,11 +1,15 @@
 import type { User } from '@/types/auth.types';
 
 export function hasPermission(user: User | null, code: string): boolean {
-  return user?.permissions?.includes(code) ?? false;
+  if (!user) return false;
+  if (user.appRole === 'admin') return true;
+  return user.permissions?.includes(code) ?? false;
 }
 
 export function hasAnyPermission(user: User | null, ...codes: string[]): boolean {
-  return codes.some(c => user?.permissions?.includes(c));
+  if (!user) return false;
+  if (user.appRole === 'admin') return true;
+  return codes.some(c => user.permissions?.includes(c));
 }
 
 export function isAdmin(user: User | null): boolean {