[Issue]: Department-based roles and server-side permissions #10

Branch Name

feature/10-permissions

Task

Description
Map each user's department to a role and enforce permissions on the server, so access control never depends on the desktop app.

Scope

• Define the roles and what each one can do
• Map departments to roles
• Authorization policies in the API
• Return 403 when a role lacks permission

Acceptance Criteria

• A user's role is determined by their department
• Protected endpoints check the required role
• The API returns 403 when the role is not allowed
• The roles and permissions are documented for the presentation to Nafissa

Checklist

• I have checked for duplicate issues.
• I have assigned the issue to the correct project board.
• I have tagged the issue properly.

Code of Conduct

• I agree to follow this project's Code of Conduct