feat(org): panel-based access system replacing roles (procurement/inventory)

- new tables user_panels (panel: procurement/inventory/pm + level full/limited)
  and user_project_members (M:N membership, separate from pm responsibility)
- UserContext carries panels + member_project_ids; /users/me and the users
  list include them
- admin endpoints: PUT /users/{id}/panels, PUT /users/{id}/panel-projects
- inventory scope: panel inventory 'full' -> manager scope (all projects, NO
  stock change); 'limited' -> supervisor scope (own memberships, stock change
  allowed); legacy roles kept as migration fallback; admin untouched
- procurement writes: _procurement_writer is now panel-aware (admin, legacy
  procurement_manager, or procurement 'full') across all 18 write routers;
  quote CREATE additionally allows 'limited' users restricted to their member
  projects (validated server-side)
- frontend: panel-aware HomeRoute (inventory -> warehouse panel, procurement
  limited -> minimal RequesterHome), wizard project options restricted for
  limited users, change-inventory button/route gated to inventory 'limited',
  organization panel gains the panels & access-levels management section

backend/app/routers/schedule_steps.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.procurement import Termsheet, TermsheetScheduleStep
 from app.schemas.procurement import ScheduleStepCreate, ScheduleStepUpdate
@@ -16,7 +16,7 @@ router = APIRouter(
     prefix="/quotes/{quote_id}/termsheets/{termsheet_id}/schedule-steps",
     tags=["schedule-steps"],
 )
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 async def _termsheet_or_404(db: AsyncSession, quote_id, termsheet_id) -> Termsheet: