fix(permissions): restore admin access after page reload

- /api/auth/me now returns app-role permissions (was empty after reload).
- client hasPermission/hasAnyPermission now bypass admin so UI queries are not disabled when permissions array is stale.

client/src/lib/permissions.ts

@@ -1,11 +1,15 @@
 import type { User } from '@/types/auth.types';
 
 export function hasPermission(user: User | null, code: string): boolean {
-  return user?.permissions?.includes(code) ?? false;
+  if (!user) return false;
+  if (user.appRole === 'admin') return true;
+  return user.permissions?.includes(code) ?? false;
 }
 
 export function hasAnyPermission(user: User | null, ...codes: string[]): boolean {
-  return codes.some(c => user?.permissions?.includes(c));
+  if (!user) return false;
+  if (user.appRole === 'admin') return true;
+  return codes.some(c => user.permissions?.includes(c));
 }
 
 export function isAdmin(user: User | null): boolean {

server/routes/auth.core.routes.ts

@@ -189,6 +189,7 @@ export function registerAuthCoreRoutes(router: Router): void {
       if (!user) {
         return res.status(401).json({ success: false, error: 'Пользователь не найден' });
       }
+      const permissions = await storage.getAppRolePermissions(user.appRole);
       res.json({
         success: true,
         user: {
@@ -198,7 +199,7 @@ export function registerAuthCoreRoutes(router: Router): void {
           lastName: user.lastName,
           middleName: user.middleName,
           appRole: user.appRole,
-          permissions: (user as any).permissions || [],
+          permissions,
           organization: user.organization ? {
             id: user.organization.id,
             name: user.organization.name,