feat: RMM Overshell, IT Glue audit/write-back, LogLift, link-aware bundles, dashboard overhaul

- RMM Overshell (migration 077): admin page, dispatch UI, executor/worker, target
  resolver, script registry (AD/DHCP/DNS/event-log/services/software/network/loglift)
- LogLift evidence pipeline (migration 078): upload webhook, B2 storage client,
  receiver/matcher, EventLogCollector PowerShell script
- IT Glue audit + write-back (migrations 075, 076): asset-audit runner, ticket
  xrefs, applications/configurations browse pages + apply/revert/audit endpoints
- Link-aware analyzer bundles (migration 073) + provider toggle (migration 074):
  link-discovery service, OpenRouter LLM provider, related-tickets/itglue-suggestion
  panels, analyze-bundle endpoint
- Endpoint data model + device-link reconciliation (migrations 079, 080): conflicts
  admin page, reconciler service, resolve endpoints
- Dashboard overhaul: integration-health service + alerts, overview/health endpoints
- Permissions: add itglue + rmm scopes; middleware: public /api/rmm/loglift route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/permissions.ts

@@ -22,6 +22,12 @@ export const statement = {
   
   // Settings management
   settings: ["read", "update"],
+
+  // IT Glue documentation read/write (Phase 4 — asset audit + write-back)
+  itglue: ["read", "write"],
+
+  // Datto RMM Overshell evidence (Phase 4.2 — read jobs / execute scripts)
+  rmm: ["read", "execute"],
 } as const;
 
 // Create access control instance
@@ -36,6 +42,8 @@ export const superAdminRole = ac.newRole({
   roles: ["create", "read", "update", "delete"],
   auditLog: ["read"],
   settings: ["read", "update"],
+  itglue: ["read", "write"],
+  rmm: ["read", "execute"],
 });
 
 // Admin role - access to admin panel and user management, but not role management
@@ -47,6 +55,8 @@ export const adminRole = ac.newRole({
   roles: ["read"],
   auditLog: ["read"],
   settings: ["read"],
+  itglue: ["read", "write"],
+  rmm: ["read", "execute"],
 });
 
 // User role - basic access
@@ -58,6 +68,8 @@ export const userRole = ac.newRole({
   roles: [],
   auditLog: [],
   settings: [],
+  itglue: ["read"],
+  rmm: ["read"],
 });
 
 // Helper function to check if a user has a specific permission