Revert 253c922: restore the PM/RBAC work to the integration

Reverting the production revert so the pm branch can merge cleanly on
top of the restored RBAC base. Conflicts against newer integration work
resolved by combining:
- App.tsx: v7's bot-draft wizard bypass + login returnUrl kept alongside
  the supervisor gating (no-project block screen, panel scoping)
- LoginPage: returnUrl navigation kept, supervisor routing added
- migration.sql: bot_drafts table kept, unified-projects ALTERs restored

backend/app/routers/units.py

@@ -3,6 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
+from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import AttributeDefinition, Material, MaterialUnit, Unit
 from app.models.procurement import LineItem, LineItemSpec
@@ -11,6 +12,7 @@ from app.utils.errors import ConflictError, NotFoundError
 from app.utils.pagination import paginate, sort_query
 
 router = APIRouter(prefix="/units", tags=["units"])
+_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def unit_full_to_dict(unit: Unit) -> dict:
@@ -45,7 +47,11 @@ async def list_units(
 
 
 @router.post("", status_code=201)
-async def create_unit(payload: UnitCreate, db: AsyncSession = Depends(get_db)):
+async def create_unit(
+    payload: UnitCreate,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     duplicate = await db.scalar(select(Unit.id).where(Unit.code == payload.code))
     if duplicate is not None:
         raise ConflictError("واحدی با این کد قبلاً ثبت شده است", field="code")
@@ -70,7 +76,12 @@ async def get_unit(unit_id: int, db: AsyncSession = Depends(get_db)):
 
 
 @router.patch("/{unit_id}")
-async def update_unit(unit_id: int, payload: UnitUpdate, db: AsyncSession = Depends(get_db)):
+async def update_unit(
+    unit_id: int,
+    payload: UnitUpdate,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     unit = await db.get(Unit, unit_id)
     if unit is None:
         raise NotFoundError("واحد یافت نشد")
@@ -92,7 +103,11 @@ async def update_unit(unit_id: int, payload: UnitUpdate, db: AsyncSession = Depe
 
 
 @router.delete("/{unit_id}")
-async def delete_unit(unit_id: int, db: AsyncSession = Depends(get_db)):
+async def delete_unit(
+    unit_id: int,
+    db: AsyncSession = Depends(get_db),
+    _auth=Depends(_procurement_writer),
+):
     unit = await db.get(Unit, unit_id)
     if unit is None:
         raise NotFoundError("واحد یافت نشد")