feat: PM panel under ERP shell + project-supervisor role

- /panel/pm: the PM app (served on the same origin under /pm) is embedded as
  a full-height iframe; supervisors are funneled there from every route,
  ERP MobileTabBar hidden on that route
- Panels menu: «مدیریت پروژه (PM)» is an internal route (admin/pm/supervisor
  only — procurement managers do not see it); PM link is no longer external
- New system role 'supervisor' (user_role enum): label in users router,
  allowed in UserRoleUpdate schema, deny-by-default on all ERP routers;
  admin panel can grant/revoke it alongside procurement manager
- Removed the obsolete VITE_PM_URL build plumbing (same-origin now)

frontend/src/components/PanelMenu.tsx

@@ -6,6 +6,8 @@ import { cn } from "../lib/utils";
 export interface MenuItem {
   label?: string;
   to?: string;
+  // لینک خارجی (اپ جداگانه، مثل سامانه PM) — در تب جدید باز می‌شود
+  href?: string;
   active?: boolean;
   divider?: boolean;
   onClick?: () => void;
@@ -112,6 +114,21 @@ export function PanelMenu({ items, title }: { items: MenuItem[]; title?: string
                   </div>
                 )}
               </div>
+            ) : it.href ? (
+              <a
+                key={i}
+                href={it.href}
+                target="_blank"
+                rel="noopener noreferrer"
+                onClick={() => setOpen(false)}
+                className={cn(
+                  "flex items-center justify-between gap-3 rounded-lg px-3 py-2 text-[13px] no-underline",
+                  it.active ? "bg-accent font-bold text-white" : "text-ink hover:bg-slate-bg",
+                )}
+              >
+                {it.label}
+                <span aria-hidden className="text-[10px] opacity-60">↗</span>
+              </a>
             ) : it.to ? (
               <Link
                 key={i}