fix(permissions): restore admin access after page reload

- /api/auth/me now returns app-role permissions (was empty after reload).
- client hasPermission/hasAnyPermission now bypass admin so UI queries are not disabled when permissions array is stale.

server/routes/auth.core.routes.ts

@@ -189,6 +189,7 @@ export function registerAuthCoreRoutes(router: Router): void {
       if (!user) {
         return res.status(401).json({ success: false, error: 'Пользователь не найден' });
       }
+      const permissions = await storage.getAppRolePermissions(user.appRole);
       res.json({
         success: true,
         user: {
@@ -198,7 +199,7 @@ export function registerAuthCoreRoutes(router: Router): void {
           lastName: user.lastName,
           middleName: user.middleName,
           appRole: user.appRole,
-          permissions: (user as any).permissions || [],
+          permissions,
           organization: user.organization ? {
             id: user.organization.id,
             name: user.organization.name,