"""IAM app — Roles, Permissions, Policies, AuthorizationEngine.

Permission codenames follow ``module.resource.action`` (Rule #5). They are
declared in code via the `PermissionRegistry` and synced to the DB on
`post_migrate` so deployments never miss a permission row.
"""