Add comprehensive access control with role-based permissions

[Smartdevs17]

Description

API lacks fine-grained access control. Implement RBAC with roles, permissions, and resource-level authorization.

Acceptance Criteria

• Role definitions (admin, operator, viewer, user)
• Permission matrix with resource-level granularity
• Middleware for authorization checks
• Role assignment API with audit
• API key scoping with permission set
• Unauthorized access monitoring

Technical Scope

• api/src/middleware/
• api/src/controllers/
• Edge: permission explosion, role hierarchy resolution, temporary elevation