feat: Proxmox management suite — hardware, firewall, pools, disks, storage, access, node admin

- VM/LXC hardware editor with PCI/USB passthrough (BIOS/OVMF + efidisk,
  machine type, VGA, SCSI controller, CPU sockets); passthrough locked while running
- Firewall at datacenter/node/VM levels: rules, security groups, IP sets,
  aliases, options, log — with rule dialog referencing security groups
- Resource pools (CRUD + membership) and per-instance tags editor
- Node disks: physical disk list, SMART viewer, ZFS pool create/destroy, wipe
- Storage: add LVM/LVM-thin/ZFS/RBD/CephFS types + enable/disable toggle
- PVE Access: API tokens (create with one-time secret, delete) and realms (LDAP/AD/OpenID)
- Node admin: systemd services (start/stop/restart), APT updates & repositories
- Shared: SelectTrigger defaults to full width (fixes narrow dropdowns)

Also bundles related in-progress work: auth screen refresh, node shell console
page, server-updates badge, and node:*/access:* RBAC permissions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/migrations/migrations.py

@@ -1430,6 +1430,44 @@ def migrate_user_quotas(conn):
     logger.info("✓ user_quotas table created")
 
 
+def migrate_granular_permissions(conn):
+    """
+    Migration 29: Backfill granular RBAC permissions.
+
+    Splits umbrella permissions (server:view/manage, vm:view, user:manage) into
+    granular ones (firewall:*, network:*, node:*, storage:*, pool:*, access:*)
+    for existing roles, and ensures the default roles include the new keys.
+    """
+    logger.info("Migration 29: Backfilling granular RBAC permissions...")
+
+    if not table_exists(conn, 'roles'):
+        logger.info("Table roles does not exist, skipping granular permissions migration")
+        return
+
+    try:
+        from app.rbac.migration import (
+            backfill_granular_permissions,
+            ensure_default_roles_new_format,
+        )
+    except ImportError:
+        try:
+            from backend.app.rbac.migration import (
+                backfill_granular_permissions,
+                ensure_default_roles_new_format,
+            )
+        except ImportError:
+            logger.warning("Could not import RBAC utilities, skipping granular permissions migration")
+            return
+
+    updated = backfill_granular_permissions(conn)
+    logger.info(f"Backfilled granular permissions for {updated} role(s)")
+
+    # Ensure default roles pick up the new granular keys as well
+    ensure_default_roles_new_format(conn)
+
+    logger.info("✓ Granular permissions migration completed")
+
+
 def run_all_migrations(engine, db_session=None):
     """
     Run all migrations in order.
@@ -1668,6 +1706,14 @@ def run_all_migrations(engine, db_session=None):
                 logger.warning(f"User quotas migration: {e}")
                 conn.rollback()
 
+            # Migration 29: Backfill granular RBAC permissions
+            try:
+                migrate_granular_permissions(conn)
+                conn.commit()
+            except Exception as e:
+                logger.warning(f"Granular permissions migration: {e}")
+                conn.rollback()
+
         logger.info("=" * 50)
         logger.info("✓ All migrations completed successfully")
         logger.info("=" * 50)