feat(rbac): gate pages and action buttons in the UI by permission

Nav already hides pages a role can't view (NAV_REQUIRED_PERMISSION). This wraps
the sensitive/CRUD action controls in <Can permission> so users only see what
they can do (server still enforces):

- POS/orders: void → VoidOrder, cancel → VoidOrder, transfer → EditOrder,
  pay/split → HandlePayments
- menu/inventory/coupons/customers/reservations/expenses/taxes/branches:
  add/edit/delete buttons → the matching Create/Edit/Delete permission
- reports CSV export → ExportReports; SMS send → SendSms, settings → ManageSmsSettings
- home dashboard: revenue/orders KPI queries gated on ViewReports so non-report
  roles don't 403 on the landing page

(Refund/discount/comp/cash-drawer have no UI control yet — no buttons to gate.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/dashboard/src/components/coupons/coupons-screen.tsx

@@ -16,6 +16,7 @@ import { LabeledField } from "@/components/ui/labeled-field";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
 import { ConfirmDialog } from "@/components/ui/confirm-dialog";
+import { Can } from "@/components/auth/can";
 
 export function CouponsScreen() {
   const t = useTranslations("coupons");
@@ -68,10 +69,12 @@ export function CouponsScreen() {
     <div className="space-y-4">
       <div className="flex items-center justify-between">
         <h2 className="text-xl font-bold">{t("title")}</h2>
-        <Button onClick={() => setShowForm(!showForm)}>
-          <Plus className="h-4 w-4" />
-          {t("addCoupon")}
-        </Button>
+        <Can permission="CreateCoupon">
+          <Button onClick={() => setShowForm(!showForm)}>
+            <Plus className="h-4 w-4" />
+            {t("addCoupon")}
+          </Button>
+        </Can>
       </div>
 
       {showForm && (
@@ -148,16 +151,18 @@ export function CouponsScreen() {
                   {c.usageLimit ? ` / ${formatNumber(c.usageLimit)}` : ""}
                 </p>
                 <div className="mt-2 flex justify-end">
-                  <Button
-                    type="button"
-                    size="sm"
-                    variant="ghost"
-                    className="text-red-600 hover:bg-red-50 hover:text-red-700"
-                    onClick={() => setDeleteTarget(c)}
-                  >
-                    <Trash2 className="me-1.5 size-4" />
-                    {tCommon("delete")}
-                  </Button>
+                  <Can permission="DeleteCoupon">
+                    <Button
+                      type="button"
+                      size="sm"
+                      variant="ghost"
+                      className="text-red-600 hover:bg-red-50 hover:text-red-700"
+                      onClick={() => setDeleteTarget(c)}
+                    >
+                      <Trash2 className="me-1.5 size-4" />
+                      {tCommon("delete")}
+                    </Button>
+                  </Can>
                 </div>
               </CardContent>
             </Card>