feat: roles/permissions system and Nostr profile display on admin users

Introduce granular role-based permissions with SuperAdmin env override, admin roles UI, and permission-gated API routes. Fix admin user Nostr metadata by batching relay profile fetches, normalizing npub pubkeys to hex, and adding reusable NostrAvatar/useNostrProfile components.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/prisma/schema.prisma

@@ -10,13 +10,24 @@ datasource db {
 model User {
   id          String   @id @default(uuid())
   pubkey      String   @unique
-  role        String   @default("USER") // USER, MODERATOR, ADMIN
+  role        String? // admin, moderator, writer. Null means Guest (no elevated role). SuperAdmin is env-sourced and never stored.
   displayName String?
   username    String?  @unique
   createdAt   DateTime @default(now())
   updatedAt   DateTime @updatedAt
 }
 
+// Maps an assignable role to a granted permission key. Editable at runtime.
+// One row per (role, permission). SuperAdmin is never stored here; it bypasses
+// all checks via the env list.
+model RolePermission {
+  role       String
+  permission String
+  createdAt  DateTime @default(now())
+
+  @@id([role, permission])
+}
+
 model Organizer {
   id        String   @id @default(uuid())
   name      String