merge: pm (unified access matrix, limited procurement flow, platform rebrand)

# Conflicts:
#	frontend/src/App.tsx
#	frontend/src/pages/Auth/LoginPage.tsx
#	frontend/src/pages/Wizard/WizardPage.tsx

frontend/src/lib/api.ts

@@ -263,6 +263,10 @@ async function patchData<T>(path: string, body: unknown): Promise<T> {
   }
   return res as T;
 }
+async function putData<T>(path: string, body: unknown): Promise<T> {
+  const res = await request<{ data: T }>(path, { method: "PUT", body: JSON.stringify(body) });
+  return res.data;
+}
 async function deleteData<T>(path: string): Promise<T> {
   const res = await request<any>(path, { method: "DELETE" });
   if (res && typeof res === "object" && "data" in res) {
@@ -1806,9 +1810,9 @@ export const apiV26 = {
       patchData<UserRow>(`/users/${id}`, { role }),
     // لایه پنل‌ها — تخصیص پنل + سطح دسترسی و عضویت پروژه‌ای (فقط ادمین)
     setPanels: async (id: string, panels: Record<string, string>): Promise<UserRow> =>
-      patchData<UserRow>(`/users/${id}/panels`, { panels }),
+      putData<UserRow>(`/users/${id}/panels`, { panels }),
     setPanelProjects: async (id: string, project_ids: string[]): Promise<UserRow> =>
-      patchData<UserRow>(`/users/${id}/panel-projects`, { project_ids }),
+      putData<UserRow>(`/users/${id}/panel-projects`, { project_ids }),
     assignProject: async (id: string, projectId: string | null): Promise<UserRow> =>
       postData<UserRow>(`/users/${id}/project`, { project_id: projectId }),
     // همگام‌سازی هویت‌ها از Casdoor (ادمین/مدیر تدارکات) — نقش‌ها دست‌نخورده می‌مانند