feat: roles/permissions system and Nostr profile display on admin users

Introduce granular role-based permissions with SuperAdmin env override, admin roles UI, and permission-gated API routes. Fix admin user Nostr metadata by batching relay profile fetches, normalizing npub pubkeys to hex, and adding reusable NostrAvatar/useNostrProfile components.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/app/login/page.tsx

@@ -38,11 +38,11 @@ export default function LoginPage() {
   const [bunkerInput, setBunkerInput] = useState("");
 
   useEffect(() => {
-    if (!loading && user) redirectByRole(user.role);
+    if (!loading && user) redirectFor(user);
   }, [user, loading]);
 
-  function redirectByRole(role: string) {
-    if (role === "ADMIN" || role === "MODERATOR") {
+  function redirectFor(u: { isSuperAdmin?: boolean; permissions?: string[] }) {
+    if (u.isSuperAdmin || (u.permissions?.length ?? 0) > 0) {
       router.push("/admin/overview");
     } else {
       router.push("/dashboard");
@@ -78,7 +78,7 @@ export default function LoginPage() {
       setLoggingIn(true);
       const loggedInUser = await loginWithConnectedSigner(signer);
       await signer.close().catch(() => {});
-      redirectByRole(loggedInUser.role);
+      redirectFor(loggedInUser);
     } catch (err: any) {
       if (controller.signal.aborted) return;
       setError(err.message || "Connection failed");
@@ -104,7 +104,7 @@ export default function LoginPage() {
     setLoggingIn(true);
     try {
       const loggedInUser = await login();
-      redirectByRole(loggedInUser.role);
+      redirectFor(loggedInUser);
     } catch (err: any) {
       setError(err.message || "Login failed");
     } finally {
@@ -118,7 +118,7 @@ export default function LoginPage() {
     setLoggingIn(true);
     try {
       const loggedInUser = await loginWithBunker(bunkerInput.trim());
-      redirectByRole(loggedInUser.role);
+      redirectFor(loggedInUser);
     } catch (err: any) {
       setError(err.message || "Connection failed");
     } finally {