Add initial project files

docs/core/permission/backend.md

@@ -0,0 +1,77 @@
+# Permission Backend
+
+The backend Permission module exposes available permission definitions. It is used by AccessControl when assigning permissions to roles.
+
+Source: `apps/backend/app/base_modules/Permission/`
+
+## Route
+
+| Method | Route         | Controller Method | Auth Required | Purpose                                      |
+| ------ | ------------- | ----------------- | ------------- | -------------------------------------------- |
+| `GET`  | `/permission` | `index`           | Yes           | Return all available permission definitions. |
+
+Route file:
+
+```txt
+apps/backend/app/base_modules/Permission/routes.ts
+```
+
+## Request Flow
+
+```txt
+GET /permission
+  -> auth middleware
+  -> PermissionController.index
+  -> getAllPermissions()
+  -> scan backend module permission configs
+  -> return PermissionItem[]
+```
+
+## Permission Discovery
+
+Permission discovery lives in:
+
+```txt
+apps/backend/app/services/permission_service.ts
+```
+
+`getAllPermissions()` scans:
+
+```txt
+apps/backend/app/base_modules/*/config/permissions.ts
+apps/backend/app/modules/*/config/permissions.ts
+```
+
+Each config exports permission items:
+
+```ts
+type PermissionItem = {
+  slug: string;
+  name: string;
+};
+```
+
+## Current Permission Configs
+
+Core permission definitions currently include:
+
+```txt
+apps/backend/app/base_modules/Admin/config/permissions.ts
+apps/backend/app/base_modules/Role/config/permissions.ts
+apps/backend/app/base_modules/FileManager/config/permissions.ts
+```
+
+When adding a feature that needs access control, add permission definitions to the owning backend module's `config/permissions.ts`.
+
+## Admin Permission Slugs
+
+`getAdminPermissionSlugs(admin)` loads an admin's roles and returns a set of permission slugs from `role_permissions`.
+
+This function is used by backend policies to authorize operations.
+
+## Ownership Rules
+
+- Backend modules own their own permission definitions.
+- Permission service owns discovering all available permission definitions.
+- AccessControl owns assigning permission slugs to roles.
+- Auth owns returning the current user's permission slugs to the frontend.