feat: custom roles with per-permission matrix for café owners

- Owner can define named custom roles (e.g. Barista, Supervisor) with
  color, description, and a fine-grained permission set (21 permissions
  across 7 categories: admin, menu, staff, customer, reports, ops, kitchen)
- Employee assigned a custom role gets its permissions embedded in the
  JWT at login (customPerms claim) and parsed by TenantMiddleware —
  overrides the static EmployeeRole matrix for all API permission checks
- New endpoints: GET/POST/PATCH/DELETE /api/cafes/{id}/custom-roles and
  PUT /api/cafes/{id}/employees/{id}/custom-role for assignment
- Dashboard Settings → Team & Staff → Custom Roles panel with grouped
  checkbox matrix, group-level toggles, color preset picker, CRUD forms,
  and employee-count display; translations in fa/en/ar
- EF migration adds CustomRoles table + nullable CustomRoleId FK on Employees
- POS slip now shows per-item notes on both thermal print and bill preview

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/Meezi.Infrastructure/Data/Migrations/AppDbContextModelSnapshot.cs

@@ -928,6 +928,46 @@ namespace Meezi.Infrastructure.Data.Migrations
                     b.ToTable("DemoRequests");
                 });
 
+            modelBuilder.Entity("Meezi.Core.Entities.CustomRole", b =>
+                {
+                    b.Property<string>("Id")
+                        .HasColumnType("text");
+
+                    b.Property<string>("CafeId")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Color")
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTime?>("DeletedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("character varying(100)");
+
+                    b.Property<string>("PermissionsJson")
+                        .IsRequired()
+                        .HasMaxLength(2000)
+                        .HasColumnType("character varying(2000)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("CafeId");
+
+                    b.ToTable("CustomRoles");
+                });
+
             modelBuilder.Entity("Meezi.Core.Entities.Employee", b =>
                 {
                     b.Property<string>("Id")
@@ -946,6 +986,9 @@ namespace Meezi.Infrastructure.Data.Migrations
                     b.Property<DateTime>("CreatedAt")
                         .HasColumnType("timestamp with time zone");
 
+                    b.Property<string>("CustomRoleId")
+                        .HasColumnType("text");
+
                     b.Property<DateTime?>("DeletedAt")
                         .HasColumnType("timestamp with time zone");
 
@@ -976,6 +1019,8 @@ namespace Meezi.Infrastructure.Data.Migrations
 
                     b.HasIndex("BranchId");
 
+                    b.HasIndex("CustomRoleId");
+
                     b.HasIndex("CafeId", "Phone")
                         .IsUnique()
                         .HasFilter("\"DeletedAt\" IS NULL");
@@ -2812,6 +2857,17 @@ namespace Meezi.Infrastructure.Data.Migrations
                     b.Navigation("Cafe");
                 });
 
+            modelBuilder.Entity("Meezi.Core.Entities.CustomRole", b =>
+                {
+                    b.HasOne("Meezi.Core.Entities.Cafe", "Cafe")
+                        .WithMany()
+                        .HasForeignKey("CafeId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Cafe");
+                });
+
             modelBuilder.Entity("Meezi.Core.Entities.Employee", b =>
                 {
                     b.HasOne("Meezi.Core.Entities.Branch", "Branch")
@@ -2825,9 +2881,16 @@ namespace Meezi.Infrastructure.Data.Migrations
                         .OnDelete(DeleteBehavior.Cascade)
                         .IsRequired();
 
+                    b.HasOne("Meezi.Core.Entities.CustomRole", "CustomRole")
+                        .WithMany("Employees")
+                        .HasForeignKey("CustomRoleId")
+                        .OnDelete(DeleteBehavior.SetNull);
+
                     b.Navigation("Branch");
 
                     b.Navigation("Cafe");
+
+                    b.Navigation("CustomRole");
                 });
 
             modelBuilder.Entity("Meezi.Core.Entities.EmployeeBranchRole", b =>
@@ -3343,6 +3406,11 @@ namespace Meezi.Infrastructure.Data.Migrations
                     b.Navigation("Orders");
                 });
 
+            modelBuilder.Entity("Meezi.Core.Entities.CustomRole", b =>
+                {
+                    b.Navigation("Employees");
+                });
+
             modelBuilder.Entity("Meezi.Core.Entities.Employee", b =>
                 {
                     b.Navigation("Attendances");