Initial commit: Pireon Admin — headless admin panel and public API

Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer
collective, backed by the Pireon OAuth identity server. The public site is a
separate, server-rendered application consuming /api/public/v1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/Policies/RolePolicy.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Policies;
+
+use App\Models\User;
+use App\Support\Permissions;
+use Illuminate\Database\Eloquent\Model;
+
+class RolePolicy extends ResourcePolicy
+{
+    protected function resource(): string
+    {
+        return 'roles';
+    }
+
+    /**
+     * Only a super admin may touch the super_admin role itself — otherwise an
+     * administrator could edit their way up to it.
+     */
+    public function update(User $user, Model $model): bool
+    {
+        if ($model->name === 'super_admin' && ! $user->hasRole('super_admin')) {
+            return false;
+        }
+
+        return parent::update($user, $model);
+    }
+
+    /**
+     * The bootstrapping roles (super_admin, and the role new logins receive)
+     * are structural: deleting one would leave the app unable to onboard or
+     * administer anyone.
+     */
+    public function delete(User $user, Model $model): bool
+    {
+        if (in_array($model->name, Permissions::protectedRoles(), true)) {
+            return false;
+        }
+
+        return parent::delete($user, $model);
+    }
+}