Revert 253c922: restore the PM/RBAC work to the integration

Reverting the production revert so the pm branch can merge cleanly on
top of the restored RBAC base. Conflicts against newer integration work
resolved by combining:
- App.tsx: v7's bot-draft wizard bypass + login returnUrl kept alongside
  the supervisor gating (no-project block screen, panel scoping)
- LoginPage: returnUrl navigation kept, supervisor routing added
- migration.sql: bot_drafts table kept, unified-projects ALTERs restored

backend/app/routers/quote_events.py

@@ -3,6 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.procurement import Quote, QuoteEvent
 from app.schemas.procurement import NoteEventIn
@@ -11,6 +12,7 @@ from app.utils.errors import NotFoundError, ValidationError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/quotes/{quote_id}/events", tags=["quote-events"])
+_procurement_writer = require_role("admin", "procurement_manager")
 
 
 @router.get("")
@@ -34,7 +36,12 @@ async def list_events(
 
 
 @router.post("", status_code=201)
-async def create_event(quote_id, payload: NoteEventIn, db: AsyncSession = Depends(get_db)):
+async def create_event(
+    quote_id,
+    payload: NoteEventIn,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     quote = await db.get(Quote, quote_id)
     if quote is None:
         raise NotFoundError("پیشنهاد (استعلام) یافت نشد")