Merge pm (panel-based access, supervisor role) onto the restored RBAC base

Reverting 253c922 first made this merge small — only two conflicts:
- MobileTabBar: supervisor null-check combined with v7's /review hiding
- ArrivalsPage: pm's PM+supervisor scoping combined with v8's 3-way fetch
  (transfers) and its transfer-receive helpers, plus pm's canAccess gate

sql/migration.sql

@@ -690,3 +690,23 @@ ALTER TABLE projects ADD COLUMN IF NOT EXISTS updated_at TIMESTAMPTZ DEFAULT now
  (revert: restore production to the state before 730d0bd (PM/RBAC work moved to 'pm'))
 
 COMMIT;
+
+-- ---------- PANEL ACCESS (جایگزین مدل نقش) ----------
+-- تخصیص پنل + سطح دسترسی به ازای هر کاربر و عضویت M:N پروژه‌ای
+CREATE TABLE IF NOT EXISTS user_panels (
+    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    panel      TEXT NOT NULL CHECK (panel IN ('procurement', 'inventory', 'pm')),
+    level      TEXT NOT NULL CHECK (level IN ('full', 'limited')),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (user_id, panel)
+);
+CREATE TABLE IF NOT EXISTS user_project_members (
+    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id    UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    project_id UUID NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE (user_id, project_id)
+);
+
+COMMIT;