feat: two-role system — super_admin & admin program (Fasa 12)

- Replace is_admin boolean with role enum('super_admin','admin') via migration
- ProgramPolicy: admin program can only view/edit/delete own programs
- EnsureIsAdmin: accepts both roles; EnsureSuperAdmin: super_admin only
- UserController + views: super_admin can manage admin accounts
- Sidebar: user management link & role badge gated on isSuperAdmin()
- Fix Controller base class: add AuthorizesRequests trait
- Fix tests: replace nonAdmin() (invalid enum) with adminProgram() against super_admin-only route

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Http/Controllers/Admin/ProgramController.php

@@ -19,6 +19,11 @@ class ProgramController extends Controller
             ->withCount(['attendances', 'programParticipants'])
             ->latest();
 
+        // Admin program hanya nampak program sendiri
+        if (auth()->user()->isAdminProgram()) {
+            $query->where('created_by', auth()->id());
+        }
+
         if ($request->filled('search')) {
             $query->where(function ($q) use ($request) {
                 $q->where('title', 'like', '%' . $request->search . '%')
@@ -57,6 +62,8 @@ class ProgramController extends Controller
 
     public function show(Program $program): View
     {
+        $this->authorize('view', $program);
+
         $program->load([
             'qrCode',
             'certificateTemplate',
@@ -77,11 +84,15 @@ class ProgramController extends Controller
 
     public function edit(Program $program): View
     {
+        $this->authorize('update', $program);
+
         return view('admin.programs.edit', compact('program'));
     }
 
     public function update(UpdateProgramRequest $request, Program $program): RedirectResponse
     {
+        $this->authorize('update', $program);
+
         $old = $program->only([
             'title', 'status', 'checkin_start_at', 'checkin_end_at',
             'ecert_download_start_at', 'ecert_download_end_at',
@@ -98,6 +109,8 @@ class ProgramController extends Controller
 
     public function destroy(Program $program): RedirectResponse
     {
+        $this->authorize('delete', $program);
+
         if ($program->attendances()->exists()) {
             return back()->with('error', 'Program tidak boleh dipadam kerana sudah ada rekod kehadiran.');
         }
@@ -113,6 +126,8 @@ class ProgramController extends Controller
 
     public function publish(Program $program): RedirectResponse
     {
+        $this->authorize('update', $program);
+
         if ($program->status !== 'draft') {
             return back()->with('error', 'Hanya program berstatus Draf boleh diterbitkan.');
         }
@@ -125,6 +140,8 @@ class ProgramController extends Controller
 
     public function close(Program $program): RedirectResponse
     {
+        $this->authorize('update', $program);
+
         if ($program->status !== 'published') {
             return back()->with('error', 'Hanya program berstatus Diterbitkan boleh ditutup.');
         }