feat: custom roles with per-permission matrix for café owners

- Owner can define named custom roles (e.g. Barista, Supervisor) with
  color, description, and a fine-grained permission set (21 permissions
  across 7 categories: admin, menu, staff, customer, reports, ops, kitchen)
- Employee assigned a custom role gets its permissions embedded in the
  JWT at login (customPerms claim) and parsed by TenantMiddleware —
  overrides the static EmployeeRole matrix for all API permission checks
- New endpoints: GET/POST/PATCH/DELETE /api/cafes/{id}/custom-roles and
  PUT /api/cafes/{id}/employees/{id}/custom-role for assignment
- Dashboard Settings → Team & Staff → Custom Roles panel with grouped
  checkbox matrix, group-level toggles, color preset picker, CRUD forms,
  and employee-count display; translations in fa/en/ar
- EF migration adds CustomRoles table + nullable CustomRoleId FK on Employees
- POS slip now shows per-item notes on both thermal print and bill preview

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/dashboard/messages/ar.json

@@ -1203,7 +1203,54 @@
       "printer": "الطابعة",
       "printerSettings": "إعدادات الطابعة",
       "printTest": "صفحة اختبار الطباعة",
-      "shopDiscover": "اكتشاف و AI"
+      "shopDiscover": "اكتشاف و AI",
+      "team": "الفريق والموظفون",
+      "customRoles": "الأدوار المخصصة"
+    },
+    "customRoles": {
+      "title": "الأدوار المخصصة",
+      "subtitle": "حدّد أدواراً بصلاحيات مخصصة لموظفيك",
+      "newRole": "دور جديد",
+      "editRole": "تعديل الدور",
+      "name": "اسم الدور",
+      "namePlaceholder": "مثلاً: باريستا، مشرف الطابق",
+      "description": "الوصف (اختياري)",
+      "descriptionPlaceholder": "وصف مختصر لهذا الدور",
+      "color": "اللون",
+      "permissions": "الصلاحيات",
+      "empty": "لم يتم تعريف أي أدوار مخصصة بعد",
+      "saveError": "فشل حفظ الدور",
+      "deleteConfirm": "حذف الدور «{name}»؟ سيعود الموظفون إلى صلاحيات دورهم الأساسي.",
+      "groupAdmin": "إدارة المقهى",
+      "groupMenu": "القائمة والمخزون",
+      "groupStaff": "الموظفون",
+      "groupCustomer": "العملاء والطاولات",
+      "groupReports": "التقارير والمالية",
+      "groupOps": "عمليات الصندوق",
+      "groupKitchen": "المطبخ والتوصيل",
+      "perm": {
+        "ManageCafeSettings": "إعدادات المقهى",
+        "ManageBilling": "الاشتراك والفواتير",
+        "ManageBranches": "إدارة الفروع",
+        "ManageMenu": "إدارة القائمة",
+        "ManageInventory": "المخزون",
+        "ManageTaxes": "الضرائب",
+        "ManagePrintSettings": "إعدادات الطباعة",
+        "ManageStaff": "إدارة الموظفين",
+        "ManageSalaries": "الرواتب",
+        "ReviewLeave": "طلبات الإجازة",
+        "ManageReservations": "الحجوزات",
+        "ManageTables": "الطاولات",
+        "ManageCoupons": "الكوبونات",
+        "ViewReports": "التقارير",
+        "ManageExpenses": "المصروفات",
+        "ProcessOrders": "معالجة الطلبات",
+        "HandlePayments": "المدفوعات",
+        "OperateRegister": "الصندوق",
+        "ManageQueue": "قائمة الانتظار",
+        "ViewKitchen": "شاشة المطبخ",
+        "HandleDelivery": "التوصيل"
+      }
     },
     "appearance": {
       "paletteSection": "لوحة الألوان",