feat: Implement Role-Based Access Control (RBAC) for Backend API Endpoints

[King24Dave]

🐛 Problem Statement

All API endpoints under /api/v1/ (projects, resources, locations,
maintenance-tickets, and sensor-sites) are currently open — any caller
can create, update, or delete records without any authentication or
authorization check. For a university-wide ICT management platform this
is a critical security gap.

✅ Acceptance Criteria

• Introduce an authentication mechanism (JWT tokens)
• Define three roles: admin, technician, viewer
• Protect write operations (POST, PUT, PATCH, DELETE) — admin and technician only
• Allow viewer role read-only access (GET endpoints only)
• Return 401 Unauthorized for unauthenticated requests
• Return 403 Forbidden when a role lacks permission
• Add tests covering all role/permission combinations
• Update API docs to reflect secured endpoints

🔧 Suggested Approach

1. Add a users table with a role column to the data model
2. Implement JWT login endpoint (/api/v1/auth/login)
3. Create a FastAPI dependency (get_current_user) to validate tokens
4. Apply role-checking dependencies to each router

📁 Files Likely Affected

• backend/app/main.py
• backend/app/api/ — all routers
• backend/app/models/ — new User model
• backend/app/services/ — new auth service
• backend/tests/ — new auth test cases
• backend/requirements.txt