feat: introduce comprehensive API documentation and RBAC guidelines

- Added a new `api.md` file detailing the TrackGo HTTP API, including agent rules, authentication mechanisms, and global HTTP contracts.
- Established a new RBAC (Role-Based Access Control) framework in `web-rbac.mdc` to ensure all product modules in `apps/web` are gated by permissions from `GET /auth/me`.
- Updated security and web module architecture rules to incorporate RBAC requirements, ensuring consistent application of permissions across modules.

This commit enhances the project's API clarity and security by providing a structured approach to user permissions and interactions.

.cursor/rules/security.mdc

@@ -13,6 +13,7 @@ Before ANY commit:
 - [ ] All user inputs validated (Zod + `@repo/ui/validators`)
 - [ ] XSS prevention — React text nodes by default; never unsanitized `dangerouslySetInnerHTML`
 - [ ] Auth tokens only via `src/core/lib/auth.helper` and the shared `apiClient` interceptors
+- [ ] Product modules in `apps/web` wire RBAC (`moduleKey` + menu `moduleKey`); see `web-rbac.mdc`
 - [ ] No secrets in client bundles; env files only under `apps/*/.env*`
 - [ ] Error messages shown to users do not leak tokens or stack traces