feat: roles/permissions system and Nostr profile display on admin users

Introduce granular role-based permissions with SuperAdmin env override, admin roles UI, and permission-gated API routes. Fix admin user Nostr metadata by batching relay profile fetches, normalizing npub pubkeys to hex, and adding reusable NostrAvatar/useNostrProfile components.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/api/categories.ts

@@ -1,6 +1,6 @@
 import { Router, Request, Response } from 'express';
 import { prisma } from '../db/prisma';
-import { requireAuth, requireRole } from '../middleware/auth';
+import { requireAuth, requires } from '../middleware/auth';
 
 const router = Router();
 
@@ -19,7 +19,7 @@ router.get('/', async (_req: Request, res: Response) => {
 router.post(
   '/',
   requireAuth,
-  requireRole(['ADMIN', 'MODERATOR']),
+  requires('categories.manage'),
   async (req: Request, res: Response) => {
     try {
       const { name, slug, sortOrder } = req.body;
@@ -47,7 +47,7 @@ router.post(
 router.patch(
   '/:id',
   requireAuth,
-  requireRole(['ADMIN', 'MODERATOR']),
+  requires('categories.manage'),
   async (req: Request, res: Response) => {
     try {
       const category = await prisma.category.findUnique({
@@ -80,7 +80,7 @@ router.patch(
 router.delete(
   '/:id',
   requireAuth,
-  requireRole(['ADMIN']),
+  requires('categories.manage'),
   async (req: Request, res: Response) => {
     try {
       const category = await prisma.category.findUnique({