feat(auth): add canManageTemplates permission to useAuth hook and secure template access

[DibashSarkar]

Description

This PR implements robust, role-based access control for message templates. It introduces a canManageTemplates permission to ensure that only authorized users (Admin roles) can create, edit, or delete WhatsApp templates.

Note: This is part 2 of splitting up the previous monolithic PR. The migration number (037) has been safely re-sequenced to avoid collisions with upstream migrations.

Changes

• Database/RLS: Added a secure migration (037_agent_templates_permission.sql) that enforces Row Level Security (RLS) policies on the templates table.
• Server Predicate: Hardened the server-side logic in API routes to strictly enforce the canManageTemplates permission before processing mutations.
• UI Gating: Updated the useAuth hook in roles.ts to include canManageTemplates. The frontend now dynamically hides or disables template creation/editing UI elements for users without sufficient privileges.
• Testing: Added an automated unit test to verify that the permission constraints hold true for both authorized and unauthorized roles.

Why this is needed

To improve system security and ensure that standard agents or guests cannot accidentally modify critical WhatsApp approved templates, which could otherwise disrupt messaging compliance.

Testing

• Verified Row Level Security blocks unauthorized API calls.
• Tested the UI as an 'Admin' (Create/Edit buttons are visible and functional).
• Tested the UI as an 'Agent' (Create/Edit buttons are successfully hidden/disabled).
• Automated tests pass successfully (npm run test).