Add privilege management system with related migrations and guards

- Introduced a new `PrivilegesModule` to manage user privileges and access control.
- Added `RequirePrivilege` decorator to enforce privilege checks on controller handlers.
- Implemented `PrivilegesGuard` to handle authorization based on user privileges.
- Created database migrations for `privileges`, `privilege_keys`, and `privilege_details` tables.
- Updated user model to include `is_superadmin` field for enhanced access control.
- Added unit tests for the new privileges functionality and guards to ensure correct behavior.

test/auth.e2e-spec.ts

@@ -28,15 +28,15 @@ describe('Auth (e2e)', () => {
     await app.close();
   });
 
-  it('GET / remains public', () => {
-    return request(app.getHttpServer())
+  it('GET / remains public', async () => {
+    await request(app.getHttpServer())
       .get('/')
       .expect(200)
       .expect('Hello World!');
   });
 
-  it('GET /auth/me without token returns 401', () => {
-    return request(app.getHttpServer()).get('/auth/me').expect(401);
+  it('GET /auth/me without token returns 401', async () => {
+    await request(app.getHttpServer()).get('/auth/me').expect(401);
   });
 
   it('register → me → refresh → revoke → me 401', async () => {
@@ -61,7 +61,12 @@ describe('Auth (e2e)', () => {
       .set('Authorization', `Bearer ${accessToken}`)
       .expect(200);
 
-    expect(me.body).toMatchObject({ username: username.toLowerCase() });
+    expect(me.body).toMatchObject({
+      username: username.toLowerCase(),
+      isSuperadmin: false,
+      privilege: null,
+      permissions: {},
+    });
 
     const refreshed = await request(app.getHttpServer())
       .post('/auth/refresh')