[CLAUDE] Domain+Infra: Plan CA Chunk A — Add role CatalogManager + seed 9 menu CRUD

- AppRoles.cs +CatalogManager const + update All array (6 LOC)
- DbInitializer.cs RoleLabels +CatalogManager ("DM", "Nhân viên Quản lý danh mục")
- DbInitializer.cs +SeedCatalogManagerPermissionsAsync() method ~50 LOC
- Wire seed call vào SeedAdminPermissionsAsync chain (idempotent, mirror SeedPePermissionDefaults pattern)

Permission scope: 9 menu key CRUD all true
- Master (root) + Suppliers + Projects + Departments
- Catalogs (root) + CatalogUnits + CatalogMaterials + CatalogServices + CatalogWorkItems

Verify:
- dotnet build SolutionErp.slnx PASS 0 err, 2 pre-existing DocxRenderer warn
- Idempotent: skip per-(role,menuKey) existing row
- 0 FE touch (Chunk B Implementer parallel commit 06a441c)

Plan CA: anh chốt move "Cấu hình danh mục dùng chung" từ fe-admin → fe-user.
Admin tạo role CatalogManager gán user nào cần CRUD; phần phân quyền User
giữ trong fe-admin Permission Matrix (existing /system/permissions).

Pending Chunk C: sidebar filter 2 app (fe-admin HIDE 9 menu, fe-user SHOW)
Pending Chunk D: smoke verify + tạo demo user catalog.manager@solutions.com.vn

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/SolutionErp.Domain/Identity/AppRoles.cs

@@ -15,9 +15,15 @@ public static class AppRoles
     public const string AuthorizedSigner = "AuthorizedSigner";
     public const string HrAdmin = "HrAdmin";
 
+    // [Plan CA S29 2026-05-22] Role mới — quản lý danh mục dùng chung
+    // (Suppliers/Projects/Departments/Catalogs) sau khi move FE từ admin → eoffice.
+    // Admin tạo role gán user nào cần CRUD danh mục; role-based access control.
+    public const string CatalogManager = "CatalogManager";
+
     public static readonly string[] All = [
         Admin, Drafter, DeptManager, ProjectManager,
         Procurement, CostControl, Finance, Accounting, Equipment,
         Director, AuthorizedSigner, HrAdmin,
+        CatalogManager,
     ];
 }