feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

app/main.py

@@ -30,6 +30,7 @@ from app.routes import (
     auth,
     companies,
     contacts,
+    groups,
     health,
     import_export,
     metrics,
@@ -160,6 +161,22 @@ async def lifespan(app: FastAPI):
 
         await db.commit()
 
+    # Initialize permission registry with active plugin names
+    from app.core.permission_registry import init_permission_registry, register_plugin_permissions
+    active_plugin_names: set[str] = set()
+    async with async_session() as db:
+        result = await db.execute(
+            sa_select(PluginModel).where(PluginModel.active == True)  # noqa: E712
+        )
+        for record in result.scalars().all():
+            active_plugin_names.add(record.name)
+            plugin = registry.get_plugin(record.name)
+            if plugin and plugin.manifest.permissions:
+                register_plugin_permissions(record.name, plugin.manifest.permissions)
+
+    init_permission_registry(active_plugin_names)
+    logger.info("Permission registry initialized with %d active plugins", len(active_plugin_names))
+
     # Seed default data (EUR currency, 19%/7% tax rates) for all tenants
     from app.core.seeds import seed_default_data
 
@@ -198,6 +215,7 @@ def create_app() -> FastAPI:
     app.include_router(auth.router)
     app.include_router(users.router)
     app.include_router(roles.router)
+    app.include_router(groups.router)
     app.include_router(tenants.router)
     app.include_router(notifications.router)
     app.include_router(companies.router)