feat: roles/permissions system and Nostr profile display on admin users

Introduce granular role-based permissions with SuperAdmin env override, admin roles UI, and permission-gated API routes. Fix admin user Nostr metadata by batching relay profile fetches, normalizing npub pubkeys to hex, and adding reusable NostrAvatar/useNostrProfile components.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/api/organizers.ts

@@ -1,6 +1,6 @@
 import { Router, Request, Response } from 'express';
 import { prisma } from '../db/prisma';
-import { requireAuth, requireRole } from '../middleware/auth';
+import { requireAuth, requires } from '../middleware/auth';
 import { respondIfOrganizerMigrationNeeded } from '../lib/prismaMigrationHint';
 
 const router = Router();
@@ -38,7 +38,7 @@ router.get('/by-slug/:slug', async (req: Request, res: Response) => {
 router.post(
   '/',
   requireAuth,
-  requireRole(['ADMIN', 'MODERATOR']),
+  requires('organizers.manage'),
   async (req: Request, res: Response) => {
     try {
       const { name, slug } = req.body;
@@ -66,7 +66,7 @@ router.post(
 router.patch(
   '/:id',
   requireAuth,
-  requireRole(['ADMIN', 'MODERATOR']),
+  requires('organizers.manage'),
   async (req: Request, res: Response) => {
     try {
       const organizer = await prisma.organizer.findUnique({
@@ -102,7 +102,7 @@ router.patch(
 router.delete(
   '/:id',
   requireAuth,
-  requireRole(['ADMIN']),
+  requires('organizers.manage'),
   async (req: Request, res: Response) => {
     try {
       const organizer = await prisma.organizer.findUnique({