Access-control enforcement hooks (capability checks on every action)

Pro M1.x polish: wire the access-control matrix into every admin action so Shop Managers really cannot edit profiles.