Minimal authorization

[niccofyren]

https://laravel.com/docs/12.x/authorization + our layer on top

Needs to communicate with frontend what permissions user has, somehow. We won't have this in jwt token, so needs to be via API call or similar.