feat(l1): usePermissions extensions for l1_tech + coverage flag

Adds 'l1_tech' to the AccountRole union, includes can_cover_l1 on the User
type, and exposes isL1Tech / canCoverL1 / canUseL1Surface /
canUseEngineerSurface from usePermissions. Existing isEngineer/isOwner/
etc. flags unchanged in semantics.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/src/components/layout/ProtectedRoute.tsx

@@ -32,9 +32,10 @@ export function ProtectedRoute({ requiredRole, children }: ProtectedRouteProps)
 
   if (requiredRole) {
     const ROLE_HIERARCHY: Record<EffectiveRole, number> = {
-      super_admin: 4,
-      owner: 3,
-      engineer: 2,
+      super_admin: 5,
+      owner: 4,
+      engineer: 3,
+      l1_tech: 2,
       viewer: 1,
     }
     if (ROLE_HIERARCHY[effectiveRole] < ROLE_HIERARCHY[requiredRole]) {