feat(org): panel-based access system replacing roles (procurement/inventory)

- new tables user_panels (panel: procurement/inventory/pm + level full/limited)
  and user_project_members (M:N membership, separate from pm responsibility)
- UserContext carries panels + member_project_ids; /users/me and the users
  list include them
- admin endpoints: PUT /users/{id}/panels, PUT /users/{id}/panel-projects
- inventory scope: panel inventory 'full' -> manager scope (all projects, NO
  stock change); 'limited' -> supervisor scope (own memberships, stock change
  allowed); legacy roles kept as migration fallback; admin untouched
- procurement writes: _procurement_writer is now panel-aware (admin, legacy
  procurement_manager, or procurement 'full') across all 18 write routers;
  quote CREATE additionally allows 'limited' users restricted to their member
  projects (validated server-side)
- frontend: panel-aware HomeRoute (inventory -> warehouse panel, procurement
  limited -> minimal RequesterHome), wizard project options restricted for
  limited users, change-inventory button/route gated to inventory 'limited',
  organization panel gains the panels & access-levels management section

backend/app/routers/standard_conversions.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends, Query
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.auth import require_role
+from app.auth import require_procurement_writer, require_role
 from app.db.engine import get_db
 from app.models.catalog import StandardConversion
 from app.schemas.catalog import StandardConversionCreate, StandardConversionUpdate
@@ -12,7 +12,7 @@ from app.utils.pagination import paginate
 from app.utils.serialization import to_iso
 
 router = APIRouter(prefix="/standard-conversions", tags=["standard-conversions"])
-_procurement_writer = require_role("admin", "procurement_manager")
+_procurement_writer = require_procurement_writer()
 
 
 def sc_to_dict(sc: StandardConversion) -> dict: