feat: custom roles with per-permission matrix for café owners

- Owner can define named custom roles (e.g. Barista, Supervisor) with
  color, description, and a fine-grained permission set (21 permissions
  across 7 categories: admin, menu, staff, customer, reports, ops, kitchen)
- Employee assigned a custom role gets its permissions embedded in the
  JWT at login (customPerms claim) and parsed by TenantMiddleware —
  overrides the static EmployeeRole matrix for all API permission checks
- New endpoints: GET/POST/PATCH/DELETE /api/cafes/{id}/custom-roles and
  PUT /api/cafes/{id}/employees/{id}/custom-role for assignment
- Dashboard Settings → Team & Staff → Custom Roles panel with grouped
  checkbox matrix, group-level toggles, color preset picker, CRUD forms,
  and employee-count display; translations in fa/en/ar
- EF migration adds CustomRoles table + nullable CustomRoleId FK on Employees
- POS slip now shows per-item notes on both thermal print and bill preview

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/dashboard/messages/en.json

@@ -1275,7 +1275,54 @@
       "printer": "Printer",
       "printerSettings": "Printer settings",
       "printTest": "Print test page",
-      "shopDiscover": "Discover & AI"
+      "shopDiscover": "Discover & AI",
+      "team": "Team & Staff",
+      "customRoles": "Custom Roles"
+    },
+    "customRoles": {
+      "title": "Custom Roles",
+      "subtitle": "Define roles with tailored permissions for your staff",
+      "newRole": "New Role",
+      "editRole": "Edit Role",
+      "name": "Role Name",
+      "namePlaceholder": "e.g. Barista, Floor Supervisor",
+      "description": "Description (optional)",
+      "descriptionPlaceholder": "Brief description of this role",
+      "color": "Color",
+      "permissions": "Permissions",
+      "empty": "No custom roles defined yet",
+      "saveError": "Failed to save role",
+      "deleteConfirm": "Delete role '{name}'? Employees will revert to their base role permissions.",
+      "groupAdmin": "Café Administration",
+      "groupMenu": "Menu & Inventory",
+      "groupStaff": "Staff",
+      "groupCustomer": "Customer & Tables",
+      "groupReports": "Reports & Finance",
+      "groupOps": "Register Operations",
+      "groupKitchen": "Kitchen & Delivery",
+      "perm": {
+        "ManageCafeSettings": "Café settings",
+        "ManageBilling": "Billing & subscription",
+        "ManageBranches": "Manage branches",
+        "ManageMenu": "Menu management",
+        "ManageInventory": "Inventory",
+        "ManageTaxes": "Taxes",
+        "ManagePrintSettings": "Print settings",
+        "ManageStaff": "Staff management",
+        "ManageSalaries": "Salaries",
+        "ReviewLeave": "Leave requests",
+        "ManageReservations": "Reservations",
+        "ManageTables": "Tables",
+        "ManageCoupons": "Coupons",
+        "ViewReports": "Reports",
+        "ManageExpenses": "Expenses",
+        "ProcessOrders": "Process orders",
+        "HandlePayments": "Handle payments",
+        "OperateRegister": "Register",
+        "ManageQueue": "Queue",
+        "ViewKitchen": "Kitchen display",
+        "HandleDelivery": "Delivery"
+      }
     },
     "appearance": {
       "paletteSection": "Color palette",