feat: custom roles with per-permission matrix for café owners

- Owner can define named custom roles (e.g. Barista, Supervisor) with
  color, description, and a fine-grained permission set (21 permissions
  across 7 categories: admin, menu, staff, customer, reports, ops, kitchen)
- Employee assigned a custom role gets its permissions embedded in the
  JWT at login (customPerms claim) and parsed by TenantMiddleware —
  overrides the static EmployeeRole matrix for all API permission checks
- New endpoints: GET/POST/PATCH/DELETE /api/cafes/{id}/custom-roles and
  PUT /api/cafes/{id}/employees/{id}/custom-role for assignment
- Dashboard Settings → Team & Staff → Custom Roles panel with grouped
  checkbox matrix, group-level toggles, color preset picker, CRUD forms,
  and employee-count display; translations in fa/en/ar
- EF migration adds CustomRoles table + nullable CustomRoleId FK on Employees
- POS slip now shows per-item notes on both thermal print and bill preview

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/dashboard/messages/ar.json

@@ -1203,7 +1203,54 @@
       "printer": "الطابعة",
       "printerSettings": "إعدادات الطابعة",
       "printTest": "صفحة اختبار الطباعة",
-      "shopDiscover": "اكتشاف و AI"
+      "shopDiscover": "اكتشاف و AI",
+      "team": "الفريق والموظفون",
+      "customRoles": "الأدوار المخصصة"
+    },
+    "customRoles": {
+      "title": "الأدوار المخصصة",
+      "subtitle": "حدّد أدواراً بصلاحيات مخصصة لموظفيك",
+      "newRole": "دور جديد",
+      "editRole": "تعديل الدور",
+      "name": "اسم الدور",
+      "namePlaceholder": "مثلاً: باريستا، مشرف الطابق",
+      "description": "الوصف (اختياري)",
+      "descriptionPlaceholder": "وصف مختصر لهذا الدور",
+      "color": "اللون",
+      "permissions": "الصلاحيات",
+      "empty": "لم يتم تعريف أي أدوار مخصصة بعد",
+      "saveError": "فشل حفظ الدور",
+      "deleteConfirm": "حذف الدور «{name}»؟ سيعود الموظفون إلى صلاحيات دورهم الأساسي.",
+      "groupAdmin": "إدارة المقهى",
+      "groupMenu": "القائمة والمخزون",
+      "groupStaff": "الموظفون",
+      "groupCustomer": "العملاء والطاولات",
+      "groupReports": "التقارير والمالية",
+      "groupOps": "عمليات الصندوق",
+      "groupKitchen": "المطبخ والتوصيل",
+      "perm": {
+        "ManageCafeSettings": "إعدادات المقهى",
+        "ManageBilling": "الاشتراك والفواتير",
+        "ManageBranches": "إدارة الفروع",
+        "ManageMenu": "إدارة القائمة",
+        "ManageInventory": "المخزون",
+        "ManageTaxes": "الضرائب",
+        "ManagePrintSettings": "إعدادات الطباعة",
+        "ManageStaff": "إدارة الموظفين",
+        "ManageSalaries": "الرواتب",
+        "ReviewLeave": "طلبات الإجازة",
+        "ManageReservations": "الحجوزات",
+        "ManageTables": "الطاولات",
+        "ManageCoupons": "الكوبونات",
+        "ViewReports": "التقارير",
+        "ManageExpenses": "المصروفات",
+        "ProcessOrders": "معالجة الطلبات",
+        "HandlePayments": "المدفوعات",
+        "OperateRegister": "الصندوق",
+        "ManageQueue": "قائمة الانتظار",
+        "ViewKitchen": "شاشة المطبخ",
+        "HandleDelivery": "التوصيل"
+      }
     },
     "appearance": {
       "paletteSection": "لوحة الألوان",

web/dashboard/messages/en.json

@@ -1275,7 +1275,54 @@
       "printer": "Printer",
       "printerSettings": "Printer settings",
       "printTest": "Print test page",
-      "shopDiscover": "Discover & AI"
+      "shopDiscover": "Discover & AI",
+      "team": "Team & Staff",
+      "customRoles": "Custom Roles"
+    },
+    "customRoles": {
+      "title": "Custom Roles",
+      "subtitle": "Define roles with tailored permissions for your staff",
+      "newRole": "New Role",
+      "editRole": "Edit Role",
+      "name": "Role Name",
+      "namePlaceholder": "e.g. Barista, Floor Supervisor",
+      "description": "Description (optional)",
+      "descriptionPlaceholder": "Brief description of this role",
+      "color": "Color",
+      "permissions": "Permissions",
+      "empty": "No custom roles defined yet",
+      "saveError": "Failed to save role",
+      "deleteConfirm": "Delete role '{name}'? Employees will revert to their base role permissions.",
+      "groupAdmin": "Café Administration",
+      "groupMenu": "Menu & Inventory",
+      "groupStaff": "Staff",
+      "groupCustomer": "Customer & Tables",
+      "groupReports": "Reports & Finance",
+      "groupOps": "Register Operations",
+      "groupKitchen": "Kitchen & Delivery",
+      "perm": {
+        "ManageCafeSettings": "Café settings",
+        "ManageBilling": "Billing & subscription",
+        "ManageBranches": "Manage branches",
+        "ManageMenu": "Menu management",
+        "ManageInventory": "Inventory",
+        "ManageTaxes": "Taxes",
+        "ManagePrintSettings": "Print settings",
+        "ManageStaff": "Staff management",
+        "ManageSalaries": "Salaries",
+        "ReviewLeave": "Leave requests",
+        "ManageReservations": "Reservations",
+        "ManageTables": "Tables",
+        "ManageCoupons": "Coupons",
+        "ViewReports": "Reports",
+        "ManageExpenses": "Expenses",
+        "ProcessOrders": "Process orders",
+        "HandlePayments": "Handle payments",
+        "OperateRegister": "Register",
+        "ManageQueue": "Queue",
+        "ViewKitchen": "Kitchen display",
+        "HandleDelivery": "Delivery"
+      }
     },
     "appearance": {
       "paletteSection": "Color palette",

web/dashboard/messages/fa.json

@@ -1276,7 +1276,54 @@
       "printer": "پرینتر",
       "printerSettings": "تنظیمات پرینتر",
       "printTest": "صفحه تست چاپ",
-      "shopDiscover": "کشف و AI"
+      "shopDiscover": "کشف و AI",
+      "team": "تیم و کارمندان",
+      "customRoles": "نقش‌های سفارشی"
+    },
+    "customRoles": {
+      "title": "نقش‌های سفارشی",
+      "subtitle": "نقش‌هایی با دسترسی دلخواه برای کارمندان تعریف کنید",
+      "newRole": "نقش جدید",
+      "editRole": "ویرایش نقش",
+      "name": "نام نقش",
+      "namePlaceholder": "مثلاً: باریستا، مسئول طبقه",
+      "description": "توضیح (اختیاری)",
+      "descriptionPlaceholder": "توضیح مختصر درباره این نقش",
+      "color": "رنگ",
+      "permissions": "دسترسی‌ها",
+      "empty": "هنوز نقش سفارشی تعریف نشده است",
+      "saveError": "ذخیره نقش ناموفق بود",
+      "deleteConfirm": "نقش «{name}» حذف شود؟ این کارمندان به دسترسی پیش‌فرض نقش اصلی خود بازمی‌گردند.",
+      "groupAdmin": "مدیریت کافه",
+      "groupMenu": "منو و انبار",
+      "groupStaff": "پرسنل",
+      "groupCustomer": "مشتری و میز",
+      "groupReports": "گزارش و مالی",
+      "groupOps": "عملیات صندوق",
+      "groupKitchen": "آشپزخانه و تحویل",
+      "perm": {
+        "ManageCafeSettings": "تنظیمات کافه",
+        "ManageBilling": "اشتراک و پرداخت",
+        "ManageBranches": "مدیریت شعب",
+        "ManageMenu": "مدیریت منو",
+        "ManageInventory": "انبار و موجودی",
+        "ManageTaxes": "مالیات",
+        "ManagePrintSettings": "تنظیمات چاپ",
+        "ManageStaff": "مدیریت کارمندان",
+        "ManageSalaries": "حقوق و دستمزد",
+        "ReviewLeave": "بررسی مرخصی",
+        "ManageReservations": "رزروها",
+        "ManageTables": "میزها",
+        "ManageCoupons": "کوپن‌ها",
+        "ViewReports": "گزارش‌ها",
+        "ManageExpenses": "هزینه‌ها",
+        "ProcessOrders": "ثبت سفارش",
+        "HandlePayments": "پردازش پرداخت",
+        "OperateRegister": "صندوق",
+        "ManageQueue": "صف انتظار",
+        "ViewKitchen": "نمایش آشپزخانه",
+        "HandleDelivery": "تحویل و پیک"
+      }
     },
     "appearance": {
       "paletteSection": "پالت رنگ",