feat(admin): gate user/order/city delete behind assignable HQ permissions

Add users_delete, orders_delete, cities_delete; default HQ (incl. super admin) has none until explicitly granted.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/ops/admin-cities.controller.ts

@@ -1,6 +1,10 @@
 import { Body, Controller, Delete, Get, Param, Post, Put, Query, UseGuards } from '@nestjs/common';
 import { IsString, MinLength } from 'class-validator';
 import { HqAuthGuard } from '../../common/guards/hq-auth.guard';
+import {
+  HqPermissionGuard,
+  RequireHqPermissions,
+} from '../../common/guards/hq-permission.guard';
 import { HqOperation } from '../../common/hq-operation/hq-operation.decorator';
 import { HqOperationAction } from '../../common/hq-operation/hq-operation.constants';
 import { AdminCitiesService } from './admin-cities.service';
@@ -24,6 +28,8 @@ export class AdminCitiesController {
   }
 
   @Get(':id/delete-preview')
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('cities_delete')
   deletePreview(@Param('id') id: string) {
     return this.service.deletePreview(BigInt(id));
   }
@@ -51,6 +57,8 @@ export class AdminCitiesController {
   }
 
   @Delete(':id')
+  @UseGuards(HqPermissionGuard)
+  @RequireHqPermissions('cities_delete')
   @HqOperation({
     action: HqOperationAction.CITY_DELETE,
     refType: 'CITY',