- Add 'user.create' permission for creating new users (admin-only)
- Add 'user.update' permission for updating any user's profile (admin-only)
- Add 'user.delete' permission for deleting any user's account (admin-only)

- Add user management permissions (create, update, delete) to dashboard admins
- Update comment for userRead permission to clarify its purpose

- Add create user permission for admins
- Implement update and delete permissions for both admins and regular users
- Add detailed comments explaining the permission logic

Adds and refactors data operations for the user model.
- Create: A new entry in _itemCreators is added for 'user', enabling user creation through the generic data endpoint.
- Update: The updater for 'user' is refactored to be more secure and flexible. It now accepts a raw Map<String, dynamic> from the request body and selectively applies changes for appRole, dashboardRole, and feedDecoratorStatus.
This approach prevents mass assignment vulnerabilities while allowing both admins and users to perform their permitted updates.

Updates the _handlePost function in the generic data endpoint to include a specific validation check for modelName == 'user'. This ensures that any request to create a user includes a non-empty email field, preventing the creation of invalid user records.

Modifies the _handlePut function to introduce special handling for the 'user' model. When updating a user, the raw request body map is now passed directly to the _updateItem function, bypassing the standard fromJson deserialization.
This change enables the custom user updater in the DataOperationRegistry to perform a secure, selective merge of updatable fields (like roles), preventing mass assignment vulnerabilities. For all other models, the behavior remains unchanged.

@gemini-code-assist gemini-code-assist bot left a comment

Adds try-catch blocks around the byName() enum parsing for appRole and dashboardRole in the user updater logic. This prevents unhandled ArgumentError exceptions when a client provides an invalid role string.
Instead of causing a 500 Internal Server Error, the API will now correctly return a 400 Bad Request with a clear error message, improving client-side error handling and API robustness.