Add privilege management system with related migrations and guards

- Introduced a new `PrivilegesModule` to manage user privileges and access control.
- Added `RequirePrivilege` decorator to enforce privilege checks on controller handlers.
- Implemented `PrivilegesGuard` to handle authorization based on user privileges.
- Created database migrations for `privileges`, `privilege_keys`, and `privilege_details` tables.
- Updated user model to include `is_superadmin` field for enhanced access control.
- Added unit tests for the new privileges functionality and guards to ensure correct behavior.

src/modules/auth/strategies/jwt.strategy.spec.ts

@@ -17,6 +17,8 @@ describe('JwtStrategy', () => {
     id: 'user-1',
     username: 'alice',
     passwordHash: 'hash',
+    privilegeId: null,
+    isSuperadmin: false,
     createdAt: now,
     updatedAt: now,
   };
@@ -53,7 +55,31 @@ describe('JwtStrategy', () => {
         jti: 'jti-1',
         typ: 'access',
       }),
-    ).resolves.toEqual({ id: 'user-1', username: 'alice', jti: 'jti-1' });
+    ).resolves.toEqual({
+      id: 'user-1',
+      username: 'alice',
+      jti: 'jti-1',
+      isSuperadmin: false,
+    });
+  });
+
+  it('maps isSuperadmin from the persisted user', async () => {
+    revoked.exists.mockResolvedValue(false);
+    usersService.findById.mockResolvedValue({ ...user, isSuperadmin: true });
+
+    await expect(
+      strategy.validate({
+        sub: 'user-1',
+        username: 'alice',
+        jti: 'jti-1',
+        typ: 'access',
+      }),
+    ).resolves.toEqual({
+      id: 'user-1',
+      username: 'alice',
+      jti: 'jti-1',
+      isSuperadmin: true,
+    });
   });
 
   it('rejects revoked access tokens', async () => {