feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

app/routes/auth.py

@@ -17,6 +17,7 @@ from app.schemas.auth import (
     PasswordResetRequest,
     SwitchTenantRequest,
 )
+from app.deps import get_current_user
 from app.services.auth_service import auth_service
 
 router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
@@ -72,6 +73,7 @@ async def login(
             "email": user.email,
             "name": user.name,
             "role": user.role,
+            "is_system_admin": user.is_system_admin,
             "tenant_id": str(tenant.id),
             "tenant_name": tenant.name,
             "csrf_token": csrf_token,
@@ -134,6 +136,25 @@ async def me(
     return info
 
 
+@router.get("/me/permissions")
+async def me_permissions(
+    request: Request,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Get resolved permissions for the current user.
+
+    Returns permissions, denied_permissions, field_permissions, and is_system_admin.
+    Used by frontend to enable/disable UI elements based on permissions.
+    """
+    return {
+        "permissions": current_user.get("permissions", []),
+        "denied_permissions": current_user.get("denied_permissions", []),
+        "field_permissions": current_user.get("field_permissions", {}),
+        "is_system_admin": current_user.get("is_system_admin", False),
+    }
+
+
 @router.post("/switch-tenant")
 async def switch_tenant(
     request: Request,