v1.6.7: add settings.system permission, move numbering/VAT to company tab, rename security tab to roles

- New settings.system permission with migration (idempotent INSERT)
- requireAnyPermission helper for route guards accepting multiple perms
- Move document numbering + currency/VAT cards from system tab to CompanySettings
- Rename security tab to roles, add canManageSystem alongside canManageCompany
- TOTP required endpoint and system-info now use settings.system
- Roles list now includes user_count
- Sidebar Settings link includes settings.system

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/totp.ts

@@ -207,7 +207,7 @@ export default async function totpRoutes(
   fastify.post(
     "/required",
     {
-      preHandler: [requireAuth, requirePermission("settings.company")],
+      preHandler: [requireAuth, requirePermission("settings.system")],
       bodyLimit: 10240,
     },
     async (request, reply) => {