feat: RBAC multi-user role-based access control

- Add rbac.py with User model, LDAP group-to-role mapping, page/write dependencies
- Proxy auth reads Remote-Groups header to resolve role from LDAP groups
- JWT tokens carry role claim, /me returns role + allowed pages
- Per-router page access control and viewer write protection
- Terminal WebSocket RBAC check
- Frontend filters sidebar links and routes by allowed pages
- Admin-only Settings page and RBAC override endpoints
- Mount rbac.json in docker-compose for page config persistence

dashboard/docker-compose.yml

@@ -49,6 +49,7 @@ services:
       - /volume1/docker/nas-dashboard/ssh/vps_terminal:/app/ssh/vps_id_ed25519:ro
       - /volume1/docker/nas-dashboard/ssh/known_hosts:/app/ssh/known_hosts:ro
       - /volume1/docker/chat-summarizer/data:/app/data/chat-summarizer:ro
+      - /volume1/docker/nas-dashboard/rbac.json:/volume1/docker/nas-dashboard/rbac.json
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/api/health')"]
       interval: 30s