feat: PM panel under ERP shell + project-supervisor role

- /panel/pm: the PM app (served on the same origin under /pm) is embedded as
  a full-height iframe; supervisors are funneled there from every route,
  ERP MobileTabBar hidden on that route
- Panels menu: «مدیریت پروژه (PM)» is an internal route (admin/pm/supervisor
  only — procurement managers do not see it); PM link is no longer external
- New system role 'supervisor' (user_role enum): label in users router,
  allowed in UserRoleUpdate schema, deny-by-default on all ERP routers;
  admin panel can grant/revoke it alongside procurement manager
- Removed the obsolete VITE_PM_URL build plumbing (same-origin now)

frontend/src/components/layout/MobileTabBar.tsx

@@ -81,6 +81,10 @@ export function MobileTabBar() {
   const { pathname } = useLocation();
 
   if (pathname === "/login" || pathname === "/admin") return null;
+  // پنل مدیریت پروژه: iframe تمام‌صفحه‌ی PM است و خودش تب‌بار داخلی دارد
+  if (pathname === "/panel/pm") return null;
+  // سرپرست پروژه فقطِ پنل PM است و هیچ تب ERP ندارد
+  if (role === "supervisor") return null;
   const isPM = role === "pm";
   const isOffice = role === "admin" || role === "procurement_manager";