printedparts stage 6: RBAC - declared permissions gate every mutation

get_permissions declares view/create/edit/delete/restock (seeded on
install/enable and by flask seed permissions); every write route adds
require_permission on top of jwt_required. New test proves
authentication alone is not authorization: a role-less member gets
403 where an admin succeeds.

tests/test_plugins/test_printedparts_ledger.py

@@ -119,3 +119,12 @@ def test_anonymous_cannot_mutate(client, item):
                        json={'itemname': 'X'}).status_code == 401
     assert client.post(f'/api/printedparts/items/{item}/restock',
                        json={'quantity': 1, 'badge': '1'}).status_code == 401
+
+
+def test_member_without_permission_gets_403(client, member_headers, item):
+    """Authentication alone is not authorization: a role-less user is denied."""
+    assert client.post('/api/printedparts/items', json={'itemname': 'X'},
+                       headers=member_headers).status_code == 403
+    assert client.post(f'/api/printedparts/items/{item}/restock',
+                       json={'quantity': 1, 'badge': '1'},
+                       headers=member_headers).status_code == 403