feat: per-user panel permissions system

Replace hardcoded role-based access with granular per-panel permissions.
Each user can now be assigned any combination of 6 panels (Corporate, BI
Executive, Clientes, Providers, Usuarios, Meu Dashboard) regardless of
their role. Existing users are auto-migrated with defaults based on role.

- Add src/panels.js with panel registry and default permissions
- Add permissions column to SQLite + migration for existing users
- Add requirePermission() middleware, replace requireRole on all routes
- Dynamic nav in buildHeader based on user permissions
- Permissions checkbox UI in admin panel with role presets
- Anti-lockout: users cannot remove 'usuarios' from themselves

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/panels.js

@@ -0,0 +1,22 @@
+/**
+ * Panel Registry — constantes de paineis e permissoes default
+ */
+const PANELS = [
+  { key: 'corporate',  label: 'Corporate',     route: '/corporate' },
+  { key: 'bi',         label: 'BI Executive',   route: '/admin/bi' },
+  { key: 'cliente',    label: 'Clientes',       route: '/admin/cliente' },
+  { key: 'providers',  label: 'Providers',      route: '/admin/providers' },
+  { key: 'usuarios',   label: 'Usuarios',       route: '/admin' },
+  { key: 'dashboard',  label: 'Meu Dashboard',  route: '/dashboard' },
+];
+
+const DEFAULT_PERMISSIONS = {
+  admin:     ['corporate', 'bi', 'cliente', 'providers', 'usuarios', 'dashboard'],
+  corporate: ['corporate'],
+  agente:    ['dashboard'],
+};
+
+const PANEL_ROUTE = {};
+PANELS.forEach(p => { PANEL_ROUTE[p.key] = p.route; });
+
+module.exports = { PANELS, DEFAULT_PERMISSIONS, PANEL_ROUTE };