feat: add user and role view sheets with detailed information display

- Created UserViewSheet component to display user details including username, full name, role, status, and timestamps.
- Created RoleViewSheet component to display role details including name, level, status, creation date, and associated permissions.
- Introduced permissions configuration in a new permissions.ts file, defining categories and permission codes for better management.
- Implemented middleware for authentication, ensuring access control for protected routes.

distribution_fe/lib/api.ts

@@ -3,32 +3,29 @@ import axios, { type AxiosError } from 'axios'
 export const api = axios.create({
   baseURL: process.env.NEXT_PUBLIC_API_URL ?? 'http://localhost:5089/api',
   headers: { 'Content-Type': 'application/json' },
+  withCredentials: true,
 })
 
-// Inject auth token on every request
-api.interceptors.request.use((config) => {
-  // TODO: replace with real token from cookie once auth is implemented
-  const token = typeof window !== 'undefined'
-    ? document.cookie.split('; ').find(r => r.startsWith('access-token='))?.split('=')[1]
-    : null
-  if (token) config.headers.Authorization = `Bearer ${token}`
-  return config
-})
+type UnauthorizedHandler = () => void
+let unauthorizedHandler: UnauthorizedHandler | null = null
+
+export function registerUnauthorizedHandler(fn: UnauthorizedHandler): () => void {
+  unauthorizedHandler = fn
+  return () => { unauthorizedHandler = null }
+}
 
-// Normalize error responses
 api.interceptors.response.use(
   (res) => res,
   (error: AxiosError<{ error: string }>) => {
     const status = error.response?.status
-    if (status === 401) {
-      if (typeof window !== 'undefined') window.location.href = '/login'
-      return new Promise(() => {}) // redirect in progress — never resolve so no error toast fires
+    if (status === 401 && typeof window !== 'undefined' && window.location.pathname !== '/login') {
+      unauthorizedHandler?.()
+      return new Promise(() => {})
     }
     return Promise.reject(error)
   }
 )
 
-// Helper to extract error message from API response
 export function getApiError(error: unknown): string {
   if (axios.isAxiosError(error)) {
     return error.response?.data?.error ?? error.message