feat(permissions): admin role/permission matrix + Gate::before super-admin

Phase 1 (additive, doesn't touch existing checks):
- Gate::before grants everything to holders of 'manage all' (the Admin role),
  robustly (returns true/null, never false; swallows missing-permission).
- New RolePermissionManager Livewire component + view at /admin/permissions:
  editable Roles x Permissions matrix (toggle saves instantly), create/delete
  roles, create/delete permissions. Admin role and 'manage all' are protected.
- Link to the screen from /admin/users header.
Roles are editable from the UI as chosen.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

routes/web.php

@@ -136,6 +136,7 @@ Route::get('/reports/dashboard', ReportsDashboard::class)->name('reports.dashboa
         Route::get('/users/create',       \App\Livewire\UserForm::class)->name('users.create');
         Route::get('/users/{user}',       \App\Livewire\UserView::class)->name('users.show');
         Route::get('/users/{user}/edit',  \App\Livewire\UserForm::class)->name('users.edit');
+        Route::get('/permissions',         \App\Livewire\RolePermissionManager::class)->name('permissions');
     });
 
     // Gestor de medios