hotfix: sidebar + topbar canAccess fallback — show all items for system_admin or empty permissions

frontend/src/components/layout/TopBar.tsx

@@ -22,6 +22,12 @@ export function TopBar() {
   const logoutMutation = useLogout();
   const minimizedWindows = useWindowStore((s) => s.windows.filter((w) => w.state === 'minimized'));
   const { hasPermission } = usePermission();
+  const canAccess = (perm: string): boolean => {
+    if (user?.is_system_admin) return true;
+    const perms = user?.permissions || [];
+    if (perms.length === 0) return true;
+    return hasPermission(perm);
+  };
   const restoreWindow = useWindowStore((s) => s.restoreWindow);
 
   const [userMenuOpen, setUserMenuOpen] = useState(false);
@@ -85,7 +91,7 @@ export function TopBar() {
       <div className="flex items-center gap-2">
         <NotificationBell />
         {/* Quick Create */}
-        {hasPermission('contacts:write') && (
+        {canAccess('contacts:write') && (
           <button
             onClick={() => navigate('/contacts/new')}
             className="flex items-center gap-1.5 bg-primary-600 text-white px-3 py-1.5 rounded-md text-sm font-medium hover:bg-primary-700 min-h-touch focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-500"
@@ -144,7 +150,7 @@ export function TopBar() {
               >
                 {t('topbar.profile')}
               </button>
-              {hasPermission('settings:read') && (
+              {canAccess('settings:read') && (
                 <button
                   onClick={() => { setUserMenuOpen(false); navigate('/settings'); }}
                   className="w-full text-left px-3 py-2 text-sm hover:bg-secondary-50 min-h-touch focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-500"
@@ -169,7 +175,7 @@ export function TopBar() {
                 <Bot className="w-4 h-4" aria-hidden="true" strokeWidth={2} />
                 {t('nav.agents', 'Agenten')}
               </button>
-              {hasPermission('audit:read') && (
+              {canAccess('audit:read') && (
                 <button
                   onClick={() => { setUserMenuOpen(false); navigate('/audit-log'); }}
                   className="w-full text-left px-3 py-2 text-sm hover:bg-secondary-50 min-h-touch focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-500"