feat: add tenant and user management with migrations, handlers, and tests

- Implemented tenant and user management features including:
  - Tenant creation and management with associated migrations.
  - User creation and management with associated migrations.
  - Tenant membership management with associated migrations.
  - Platform user roles management with associated migrations.
  - Quota management with associated migrations.
  - Article and template management with associated migrations.
- Added HTTP handlers for templates and workspaces.
- Created tests for protected and public routes.
- Introduced a script to check tenant scope in SQL queries.
- Documented task plan for backend completion and frontend foundation.

server/internal/shared/auth/permissions_test.go

@@ -0,0 +1,35 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPermissionsForRole_Admin(t *testing.T) {
+	perms := PermissionsForRole("tenant_admin")
+	assert.Contains(t, perms, "brand:write")
+	assert.Contains(t, perms, "brand:delete")
+	assert.Contains(t, perms, "member:write")
+}
+
+func TestPermissionsForRole_Editor(t *testing.T) {
+	perms := PermissionsForRole("editor")
+	assert.Contains(t, perms, "article:write")
+	assert.Contains(t, perms, "template:generate")
+	assert.NotContains(t, perms, "brand:delete")
+	assert.NotContains(t, perms, "member:write")
+}
+
+func TestPermissionsForRole_Viewer(t *testing.T) {
+	perms := PermissionsForRole("viewer")
+	assert.Contains(t, perms, "brand:read")
+	assert.Contains(t, perms, "article:read")
+	assert.NotContains(t, perms, "brand:write")
+	assert.NotContains(t, perms, "article:write")
+}
+
+func TestPermissionsForRole_Unknown(t *testing.T) {
+	perms := PermissionsForRole("nonexistent")
+	assert.Nil(t, perms)
+}