feat(perms): drop dead document export permissions; seed the 12 survivors via migration

offers.export/orders.export/invoices.export gated nothing on the backend (PDF
routes enforce *.view); they only toggled frontend buttons and showed dead
role checkboxes. Migration deletes them (+ role grants) and idempotently seeds
the 12 enforced doc perms (offers/orders/invoices x view/create/edit/delete) +
admin grant, so a fresh prod DB has them (closes the seed-only drift gap).
Route reverts to orders.view; the 8 frontend *.export checks now use *.view.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/pages/IssuedOrders.tsx

@@ -261,7 +261,7 @@ export default function IssuedOrders({ month, year }: IssuedOrdersProps) {
           >
             {ViewIcon}
           </IconButton>
-          {hasPermission("orders.export") && (
+          {hasPermission("orders.view") && (
             <IconButton
               size="small"
               onClick={() => handleExportPdf(o)}
@@ -356,7 +356,7 @@ export default function IssuedOrders({ month, year }: IssuedOrdersProps) {
                 title="Zatím žádné vydané objednávky."
                 description={
                   hasPermission("orders.create")
-                    ? "Vytvořte první tlačítkem „Vytvořit objednávku vydanou“."
+                    ? "Vytvořte první tlačítkem „Vytvořit objednávku."
                     : undefined
                 }
               />