revert: restore production to the state before 730d0bd (PM/RBAC work moved to 'pm')

Their three commits (730d0bd, 5a9b543, 387edfb) reached production by push and
auto-deployed. 387edfb expects a users.username column that the live database does
not have, so POST /api/v1/auth/login was returning HTTP 500. Their schema changes
never applied either (projects still has only id, name, description, start_date,
pm_user_id, created_at), so nothing depends on the reverted code.

This commit sets the tree back to exactly a02b3ea — verified with git diff against
it — while keeping history linear: the work itself is preserved on 'pm' at 387edfb.

backend/app/routers/supplier_materials.py

@@ -8,7 +8,6 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
 from app.db.engine import get_db
 from app.models.catalog import Material, MaterialCategory
 from app.models.procurement import Supplier, SupplierMaterial
@@ -19,7 +18,6 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(tags=["supplier-materials"])
-_procurement_writer = require_role("admin", "procurement_manager")
 
 
 def link_to_dict(link: SupplierMaterial, material: Material | None = None,
@@ -65,10 +63,7 @@ async def list_supplier_materials(
 
 @router.post("/suppliers/{supplier_id}/materials", status_code=201)
 async def create_supplier_material(
-    supplier_id,
-    payload: SupplierMaterialCreate,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
+    supplier_id, payload: SupplierMaterialCreate, db: AsyncSession = Depends(get_db)
 ):
     async with db.begin():
         link = await link_supplier_material(db, supplier_id, payload.material_id)
@@ -77,12 +72,7 @@ async def create_supplier_material(
 
 
 @router.delete("/suppliers/{supplier_id}/materials/{material_id}")
-async def delete_supplier_material(
-    supplier_id,
-    material_id,
-    db: AsyncSession = Depends(get_db),
-    _auth=Depends(_procurement_writer),
-):
+async def delete_supplier_material(supplier_id, material_id, db: AsyncSession = Depends(get_db)):
     async with db.begin():
         await unlink_supplier_material(db, supplier_id, material_id)
     return {"data": {"supplier_id": str(supplier_id), "material_id": str(material_id), "deleted": True}}