Add user profile page, password change, reset links, auto-seed RBAC

Backend:
- POST /v1/auth/change-password (current user)
- POST /v1/auth/reset-password/:userId (admin generates 24h signed link)
- POST /v1/auth/reset-password (token-based reset, no auth required)
- GET/PATCH /v1/auth/me (profile read/update)
- Auto-seed system permissions on server startup

Frontend:
- Profile page with name edit, password change, theme/color settings
- Sidebar user link goes to profile page (replaces dropdown)
- Users page: "Reset Password Link" in kebab (copies to clipboard)
- Sign out button below profile link

packages/backend/src/main.ts

@@ -15,6 +15,7 @@ import { productRoutes } from './routes/v1/products.js'
 import { lookupRoutes } from './routes/v1/lookups.js'
 import { fileRoutes } from './routes/v1/files.js'
 import { rbacRoutes } from './routes/v1/rbac.js'
+import { RbacService } from './services/rbac.service.js'
 
 export async function buildApp() {
   const app = Fastify({
@@ -65,6 +66,16 @@ export async function buildApp() {
   await app.register(fileRoutes, { prefix: '/v1' })
   await app.register(rbacRoutes, { prefix: '/v1' })
 
+  // Auto-seed system permissions on startup
+  app.addHook('onReady', async () => {
+    try {
+      await RbacService.seedPermissions(app.db)
+      app.log.info('System permissions seeded')
+    } catch (err) {
+      app.log.error({ err }, 'Failed to seed permissions')
+    }
+  })
+
   return app
 }