feat(perms): drop dead document export permissions; seed the 12 survivors via migration

offers.export/orders.export/invoices.export gated nothing on the backend (PDF
routes enforce *.view); they only toggled frontend buttons and showed dead
role checkboxes. Migration deletes them (+ role grants) and idempotently seeds
the 12 enforced doc perms (offers/orders/invoices x view/create/edit/delete) +
admin grant, so a fresh prod DB has them (closes the seed-only drift gap).
Route reverts to orders.view; the 8 frontend *.export checks now use *.view.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/pages/InvoiceDetail.tsx

@@ -1147,7 +1147,7 @@ export default function InvoiceDetail() {
               </Box>
             </Box>
             <Box sx={headerActionsSx}>
-              {hasPermission("invoices.export") && (
+              {hasPermission("invoices.view") && (
                 <Button
                   onClick={() => handleViewPdf(invoice.language || "cs")}
                   variant="outlined"
@@ -1690,7 +1690,7 @@ export default function InvoiceDetail() {
             </Box>
           </Box>
           <Box sx={headerActionsSx}>
-            {isEdit && invoice && hasPermission("invoices.export") && (
+            {isEdit && invoice && hasPermission("invoices.view") && (
               <Button
                 onClick={() => handleViewPdf(invoice.language || "cs")}
                 variant="outlined"