feat: implement role-based access control (RBAC)

[lakshiii08]

Summary

Implemented Role-Based Access Control (RBAC) support across the application while preserving the existing admin authentication flow.

Changes Made

• Added role field to the User model with support for user, admin, and super_admin.
• Updated JWT generation to include user roles.
• Enhanced authentication middleware to expose role information.
• Introduced reusable authorizeRoles() middleware.
• Protected privileged backend routes and enforced proper 401/403 responses.
• Secured notification ownership actions.
• Restricted frontend admin dashboard access using protected routes.
• Preserved backward compatibility with the existing adminToken-based admin system.

Result

Users can only access resources permitted by their roles, unauthorized API access is blocked appropriately, and the admin dashboard remains protected without disrupting existing functionality.

[Nsanjayboruds]

@lakshiii08 please provide screensrecording

[Nsanjayboruds]

@lakshiii08 please provide screensrecording