Add Public Relations & Protocol module (Task #649)

New, fully separate app module "العلاقات العامة والمراسم / Public
Relations and Protocol". Does not touch executive-meetings; all new
tables are prefixed protocol_ and are additive-only, routes under
/protocol.

Includes:
- 6 protocol_ tables (rooms, room bookings, external meetings, gifts,
  gift issues, audit log) in lib/db.
- API routes + role-scoped middleware (protocol_super_admin, pr_manager,
  officer, requester, viewer) with requireProtocolAccess gating.
- Room-booking conflict prevention (overlap rule newStart<existingEnd
  AND newEnd>existingStart vs pending/approved) with AR error message.
- Gifts/shields (دروع) registry + issuance with stock tracking.
- Bilingual AR/EN frontend page (tabs + dialogs) at /protocol, app tile,
  i18n keys, and seed data (roles, permission, default rooms).

Concurrency/security hardening from code review:
- All role guards now validate users.isActive (inactive-user bypass fix).
- Per-room SELECT ... FOR UPDATE lock serializes booking check-then-write.
- Approve paths re-read inside the transaction and use state-conditional
  updates (WHERE ... AND status='pending' RETURNING).
- Gift issuance claims the issue conditionally, then does an atomic
  conditional stock decrement; failure rolls back the claim.

Verified: drizzle push (6 tables), seed, frontend + api-server typecheck
(only pre-existing errors in untouched files), unauth gating returns 401,
conflict predicate confirmed. Architect review PASS.

artifacts/api-server/src/middlewares/auth.ts

@@ -253,3 +253,52 @@ export async function requireExecutiveAccess(
   next();
 }
 
+const PROTOCOL_READ_ROLES: ReadonlyArray<string> = [
+  "admin",
+  "protocol_super_admin",
+  "protocol_pr_manager",
+  "protocol_officer",
+  "protocol_requester",
+  "protocol_viewer",
+];
+
+/**
+ * Gate any read access to the Public Relations & Protocol module. Allows
+ * admin and any of the protocol_* roles. Finer-grained mutate / approve
+ * sub-roles are layered on top via local helpers in the routes file.
+ */
+export async function requireProtocolAccess(
+  req: Request,
+  res: Response,
+  next: NextFunction,
+): Promise<void> {
+  if (!req.session.userId) {
+    res.status(401).json({ error: "Unauthorized", code: "unauthorized" });
+    return;
+  }
+  const [user] = await db
+    .select({ isActive: usersTable.isActive })
+    .from(usersTable)
+    .where(eq(usersTable.id, req.session.userId));
+  if (!user || !user.isActive) {
+    res.status(401).json({ error: "Unauthorized", code: "unauthorized" });
+    return;
+  }
+  const ids = await getEffectiveRoleIds(req.session.userId);
+  if (ids.length === 0) {
+    res.status(403).json({ error: "Forbidden", code: "forbidden" });
+    return;
+  }
+  const rows = await db
+    .select({ name: rolesTable.name })
+    .from(rolesTable)
+    .where(inArray(rolesTable.id, ids));
+  const names = new Set(rows.map((r) => r.name));
+  const ok = PROTOCOL_READ_ROLES.some((r) => names.has(r));
+  if (!ok) {
+    res.status(403).json({ error: "Forbidden", code: "forbidden" });
+    return;
+  }
+  next();
+}
+

artifacts/api-server/src/routes/index.ts

@@ -16,6 +16,7 @@ import groupsRouter from "./groups";
 import rolesRouter from "./roles";
 import auditRouter from "./audit";
 import executiveMeetingsRouter from "./executive-meetings";
+import protocolRouter from "./protocol";
 import pushRouter from "./push";
 import systemRouter from "./system";
 
@@ -38,6 +39,7 @@ router.use(groupsRouter);
 router.use(rolesRouter);
 router.use(auditRouter);
 router.use(executiveMeetingsRouter);
+router.use(protocolRouter);
 router.use(pushRouter);
 router.use(systemRouter);