security: Rechteausweitung schließen & Admin-Panel feingranular gaten (K1, H1, H2, M8)

- users:manage/roles:manage auf allen User-/Rollen-Masken erzwungen;
  is_super_admin aus $fillable entfernt und nur per autorisiertem
  forceFill setzbar; zentraler Gate::before-Super-Admin-Kurzschluss (K1/M8).
- Nicht-Super-Admins können Super-Admin-Konten nicht mehr bearbeiten (Fix#2);
  Impersonation mit Rangprüfung, keine Token-Erstellung während Impersonation (H1).
- Destruktive/verwaltende Admin-Aktionen (CRM/Billing/Compliance/Struktur)
  hängen an neuen admin-only Permissions; Editor behält reine Content-Rechte (H2).
- Kanonischer Permission-Katalog (App\Authorization\Permission) als Single
  Source of Truth für Seeder und Monitoring.

Deployment: `php artisan db:seed --class=RolesAndPermissionsSeeder` auf allen
Umgebungen ausführen (neue Permissions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Admin/EditorPermissionBoundaryTest.php

@@ -0,0 +1,124 @@
+<?php
+
+use App\Http\Controllers\Api\Legacy\LegacyPressReleaseController;
+use App\Models\AppSetting;
+use App\Models\Company;
+use App\Models\Contact;
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Livewire\Volt\Volt as LivewireVolt;
+use Tests\TestCase;
+
+/**
+ * Regression zu Befund H2 (Audit 14.07.2026): Die Rolle `editor` behält ihre
+ * Content-Rechte (PMs), darf aber keine destruktiven CRM-/Billing-/Compliance-/
+ * Struktur-Aktionen ausführen. Gekoppelt an die neuen Seeder-Permissions
+ * companies:write / categories:manage / footer-codes:manage / billing:manage /
+ * compliance:manage.
+ */
+beforeEach(function () {
+    $this->seed(RolesAndPermissionsSeeder::class);
+});
+
+function editorActor(): User
+{
+    $editor = User::factory()->create();
+    $editor->assignRole('editor');
+
+    return $editor;
+}
+
+test('editor is blocked from admin-only management pages', function () {
+    /** @var TestCase $this */
+    $this->actingAs(editorActor());
+
+    foreach ([
+        'admin/categories',
+        'admin/categories/create',
+        'admin/footer-codes',
+        'admin/footer-codes/create',
+        'admin/payments',
+        'admin/coupons',
+        'admin/invoices',
+        'admin/legal-requests',
+        'admin/contact-messages',
+    ] as $path) {
+        $this->get("https://pressekonto.test/{$path}")->assertForbidden();
+    }
+});
+
+test('editor keeps access to content and read-only CRM pages', function () {
+    /** @var TestCase $this */
+    $this->actingAs(editorActor());
+
+    $this->get('https://pressekonto.test/admin/press-releases')->assertSuccessful();
+    $this->get('https://pressekonto.test/admin/companies')->assertSuccessful();
+    $this->get('https://pressekonto.test/admin/contacts')->assertSuccessful();
+});
+
+test('editor cannot open company write forms', function () {
+    /** @var TestCase $this */
+    $company = Company::factory()->presseecho()->create();
+    $this->actingAs(editorActor());
+
+    $this->get('https://pressekonto.test/admin/companies/create')->assertForbidden();
+    $this->get("https://pressekonto.test/admin/companies/{$company->id}/edit")->assertForbidden();
+});
+
+test('editor cannot delete a contact from the index', function () {
+    /** @var TestCase $this */
+    $company = Company::factory()->presseecho()->create();
+    $contact = Contact::factory()->for($company)->create();
+
+    $this->actingAs(editorActor());
+
+    LivewireVolt::test('admin.contacts.index')
+        ->call('deleteContactFromIndex', $contact->id)
+        ->assertForbidden();
+
+    expect(Contact::query()->whereKey($contact->id)->exists())->toBeTrue();
+});
+
+test('editor cannot invoke admin-only livewire actions directly', function () {
+    /** @var TestCase $this */
+    $this->actingAs(editorActor());
+
+    LivewireVolt::test('admin.categories.create')
+        ->call('save')
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.footer-codes.create')
+        ->call('save')
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.payments.index')
+        ->call('cancelBundle', 999_999)
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.legal-requests.index')
+        ->call('resolveWithdrawal', 999_999)
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.press-releases.index')
+        ->set('legacyApiAiReview', true)
+        ->assertForbidden();
+
+    expect(AppSetting::getBool(LegacyPressReleaseController::SETTING_AI_REVIEW))->toBeFalse();
+});
+
+test('admin retains access to all restricted management pages', function () {
+    /** @var TestCase $this */
+    $admin = User::factory()->create();
+    $admin->assignRole('admin');
+    $this->actingAs($admin);
+
+    foreach ([
+        'admin/categories',
+        'admin/footer-codes',
+        'admin/invoices',
+        'admin/legal-requests',
+        'admin/contact-messages',
+    ] as $path) {
+        $this->get("https://pressekonto.test/{$path}")->assertSuccessful();
+    }
+});