refactor(router): enhance role-based access control

- Improve readability and maintainability of RBAC logic
- Implement single source of truth for top-level route paths
- Redirect unauthorized users based on role permissions

Author: fulleni

lib/router/router.dart

@@ -86,24 +86,45 @@ GoRouter createRouter({
 
         // --- Role-Based Access Control (RBAC) ---
         final userRole = context.read<AppBloc>().state.user?.dashboardRole;
-        final destinationRouteName = state.topRoute?.name;
 
-        // Allow navigation if role is not yet determined or route is unknown.
-        if (userRole == null || destinationRouteName == null) {
+        // Allow navigation if the user role isn't determined yet.
+        if (userRole == null) {
           return null;
         }
 
-        final allowedRoutes = routePermissions[userRole];
+        // A local map to resolve top-level route names to their base paths.
+        // This is the single source for this mapping within the redirect logic.
+        const topLevelPaths = {
+          Routes.overviewName: Routes.overview,
+          Routes.contentManagementName: Routes.contentManagement,
+          Routes.userManagementName: Routes.userManagement,
+          Routes.appConfigurationName: Routes.appConfiguration,
+        };
 
-        // Check if the user is trying to access a route they are not
-        // permitted to view.
+        // Get the set of authorized route *names* for the user's role from
+        // the single source of truth: route_permissions.dart.
+        final allowedRouteNames = routePermissions[userRole] ?? {};
+
+        // Convert the allowed route names into a list of their base paths.
+        final authorizedPaths = allowedRouteNames
+            .map((name) => topLevelPaths[name])
+            .whereType<
+              String
+            >() // Filter out any nulls if a name is not in the map.
+            .toList();
+
+        // Check if the destination path starts with any of the authorized base
+        // paths, or if it's the universally accessible settings page.
         final isAuthorized =
-            allowedRoutes?.contains(destinationRouteName) ?? false;
+            authorizedPaths.any(
+              currentLocation.startsWith,
+            ) ||
+            currentLocation.startsWith(Routes.settings);
 
-        // Universally allowed routes like 'settings' are exempt from this check.
-        if (!isAuthorized && destinationRouteName != Routes.settingsName) {
+        if (!isAuthorized) {
           print(
-            '    Action: Unauthorized access to "$destinationRouteName". '
+            '    Action: Unauthorized access to "$currentLocation" for role '
+            '$userRole. Authorized base paths: $authorizedPaths. '
             'Redirecting to $overviewPath.',
           );
           // Redirect unauthorized users to the overview page. This is a safe