Revert 253c922: restore the PM/RBAC work to the integration

Reverting the production revert so the pm branch can merge cleanly on
top of the restored RBAC base. Conflicts against newer integration work
resolved by combining:
- App.tsx: v7's bot-draft wizard bypass + login returnUrl kept alongside
  the supervisor gating (no-project block screen, panel scoping)
- LoginPage: returnUrl navigation kept, supervisor routing added
- migration.sql: bot_drafts table kept, unified-projects ALTERs restored

frontend/src/pages/Suppliers/SupplierDetailPage.tsx

@@ -14,6 +14,7 @@ import { MultiSelectCombobox } from "../../components/MultiSelectCombobox";
 import { ConfirmDeleteDialog } from "../../components/ConfirmDeleteDialog";
 import { normalize } from "../../lib/normalize";
 import { PurchaseHistory } from "./PurchaseHistory";
+import { useAuthStore } from "../../store/auth";
 
 // تمیزکاری و استانداردسازی شماره برای شماره‌گیر خودکار موبایل (اندروید و iOS)
 function cleanPhoneForTel(phone?: string | null): string {
@@ -32,6 +33,8 @@ export function SupplierDetailPage() {
   const quotes = useQuotes();
   const materials = useMaterials();
   const topics = useAppStore((s) => s.topics);
+  const user = useAuthStore((s) => s.user);
+  const canManage = user?.role === "admin" || user?.role === "procurement_manager";
 
   const s = useMemo(() => suppliers.find((x) => x.id === id) || null, [suppliers, id]);
   const [pendingRemove, setPendingRemove] = useState<string | null>(null);
@@ -184,13 +187,15 @@ export function SupplierDetailPage() {
           </div>
 
           <div className="mt-4 flex items-center gap-2">
-            <Link
-              to={`/wizard?topic=${encodeURIComponent(topicName)}&supplier=${encodeURIComponent(s.id)}`}
-              className="btn-line-file no-underline bg-accent text-white hover:bg-accent-dark"
-            >
-              <Plus className="h-3.5 w-3.5" />
-              پیشنهاد جدید
-            </Link>
+            {canManage && (
+              <Link
+                to={`/wizard?topic=${encodeURIComponent(topicName)}&supplier=${encodeURIComponent(s.id)}`}
+                className="btn-line-file no-underline bg-accent text-white hover:bg-accent-dark"
+              >
+                <Plus className="h-3.5 w-3.5" />
+                پیشنهاد جدید
+              </Link>
+            )}
             {firstCat ? (
               <Link to={`/suppliers/category/${encodeURIComponent(firstCat)}`} className="btn-line-file no-underline">
                 ‹ بازگشت به دسته
@@ -216,19 +221,23 @@ export function SupplierDetailPage() {
               {linked.map((c) => (
                 <span key={c} className="spec-chip">
                   {c}
-                  <button type="button" className="spec-chip-x" title="حذف متریال" onClick={() => setPendingRemove(c)}>
-                    <X className="h-3 w-3" />
-                  </button>
+                  {canManage && (
+                    <button type="button" className="spec-chip-x" title="حذف متریال" onClick={() => setPendingRemove(c)}>
+                      <X className="h-3 w-3" />
+                    </button>
+                  )}
                 </span>
               ))}
             </div>
           )}
-          <MultiSelectCombobox
-            values={[]}
-            onChange={(cats) => saveCategories(cats)}
-            options={materialOptions}
-            placeholder="افزودن متریال..."
-          />
+          {canManage && (
+            <MultiSelectCombobox
+              values={[]}
+              onChange={(cats) => saveCategories(cats)}
+              options={materialOptions}
+              placeholder="افزودن متریال..."
+            />
+          )}
           {purchased.length > 0 && (
             <div className="mt-3 border-t border-line pt-2">
               <div className="mb-1 text-[11px] font-semibold text-muted">متریال‌های خریداری‌شده (از پیشنهادها):</div>