v1.6.7: add settings.system permission, move numbering/VAT to company tab, rename security tab to roles

- New settings.system permission with migration (idempotent INSERT)
- requireAnyPermission helper for route guards accepting multiple perms
- Move document numbering + currency/VAT cards from system tab to CompanySettings
- Rename security tab to roles, add canManageSystem alongside canManageCompany
- TOTP required endpoint and system-info now use settings.system
- Roles list now includes user_count
- Sidebar Settings link includes settings.system

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/admin/components/Sidebar.tsx

@@ -360,6 +360,7 @@ const menuSections: MenuSection[] = [
           "settings.company",
           "settings.banking",
           "settings.roles",
+          "settings.system",
           "settings.templates",
         ],
         icon: (