feat: Script Generator Phase 1+2 — backend, engine, API, frontend, template editor, parameter detector

Complete Script Generator feature including:

Backend:
- ScriptCategory, ScriptTemplate, ScriptGeneration models
- ScriptTemplateEngine with substitution, filters, sanitization
- CRUD + share API endpoints with permission checks
- Integration tests for permissions and sharing
- Migration 057 with AD User Management seed templates

Frontend — Script Library:
- Browse templates with category tabs and search
- Configure pane with parameter form and script generation
- Script preview with live substitution and copy/download
- scriptGeneratorStore Zustand store

Frontend — Template Editor:
- Full CRUD form with metadata, script body (Monaco Editor), parameters
- ParameterSchemaBuilder with visual builder + JSON toggle
- ScriptManagePage with routing and nav link

Frontend — Parameter Detector:
- Client-side PowerShell parameter detection engine
- Detects script-level param() blocks and variable assignments
- Type inference from PS type annotations and value patterns
- ParameterDetectorStepper one-by-one review UI with accept/skip

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/hooks/usePermissions.ts

@@ -71,5 +71,16 @@ export function usePermissions() {
     canManageCategories: hasMinimumRole(user, 'owner'),
     canManageGlobalCategories: effectiveRole === 'super_admin',
     canManageAccount: effectiveRole === 'super_admin' || effectiveRole === 'owner',
+
+    canManageScriptTemplate: (template: { created_by: string | null; team_id?: string | null }) => {
+      if (!user) return false
+      if (user.is_super_admin) return true
+      if (user.account_role === 'owner') return true
+      return template.created_by === user.id
+    },
+
+    canShareScriptTemplate: effectiveRole === 'super_admin' || effectiveRole === 'owner',
+
+    canCreateScriptTemplate: hasMinimumRole(user, 'engineer'),
   }
 }