Enforce role-based permissions across management actions

[iamrichmack111]

ServeSense currently distinguishes owner, admin, and manager accounts, but authorization should be enforced consistently across every write operation.

Acceptance criteria:

• Define explicit owner/admin/manager capabilities
• Protect staff modification routes
• Protect sales modification routes
• Protect schedule publishing
• Protect exports containing sensitive data
• Return HTTP 403 for unauthorized operations
• Add authorization tests