feat(menu-permissions): 메뉴 API 연동으로 사이드바 권한 정비

- .env.development.example과 lib/core/config/environment.dart, lib/core/permissions/permission_manager.dart에서 PERMISSION__ 폴백을 view 전용으로 좁히고 기본 정책을 명시적으로 거부하도록 재정비했다

- lib/core/navigation/*, lib/core/routing/app_router.dart, lib/widgets/app_shell.dart, lib/main.dart에서 메뉴 매니페스트·카탈로그를 도입해 /menus 응답을 캐싱하고 라우터·사이드바·Breadcrumb가 동일 menu_code/route_path를 쓰도록 리팩터링했다

- lib/core/permissions/permission_resources.dart와 그룹 권한/메뉴 마스터 모듈을 menu_code 기반 CRUD 및 Catalog 경로 정합성 검사로 전환하고 PermissionSynchronizer·PermissionBootstrapper를 확장했다

- test/helpers/test_permissions.dart, test/widgets/app_shell_test.dart 등 신규 구조를 반영하는 테스트·골든과 doc/frontend_menu_permission_tasks.md 문서를 보강했다

lib/main.dart

@@ -6,6 +6,7 @@ import 'package:get_it/get_it.dart';
 import 'package:shadcn_ui/shadcn_ui.dart';
 
 import 'core/config/environment.dart';
+import 'core/navigation/menu_catalog.dart';
 import 'core/permissions/permission_bootstrapper.dart';
 import 'core/permissions/permission_manager.dart';
 import 'core/routing/app_router.dart';
@@ -14,6 +15,7 @@ import 'core/theme/theme_controller.dart';
 import 'features/auth/application/auth_service.dart';
 import 'features/masters/group/domain/repositories/group_repository.dart';
 import 'features/masters/group_permission/domain/repositories/group_permission_repository.dart';
+import 'features/masters/menu/domain/repositories/menu_repository.dart';
 import 'injection_container.dart';
 
 /// Superport 애플리케이션 진입점. 환경 초기화 후 앱 위젯을 실행한다.
@@ -45,17 +47,24 @@ class SuperportApp extends StatefulWidget {
 class _SuperportAppState extends State<SuperportApp> {
   late final ThemeController _themeController;
   late final PermissionManager _permissionManager;
+  late final MenuCatalog _menuCatalog;
 
   @override
   void initState() {
     super.initState();
     _themeController = ThemeController();
     _permissionManager = PermissionManager();
+    _menuCatalog = MenuCatalog(repository: GetIt.I<MenuRepository>());
     if (GetIt.I.isRegistered<PermissionManager>()) {
       GetIt.I.unregister<PermissionManager>();
     }
     GetIt.I.registerSingleton<PermissionManager>(_permissionManager);
+    if (GetIt.I.isRegistered<MenuCatalog>()) {
+      GetIt.I.unregister<MenuCatalog>();
+    }
+    GetIt.I.registerSingleton<MenuCatalog>(_menuCatalog);
     unawaited(_restorePermissions());
+    unawaited(_preloadMenus());
   }
 
   @override
@@ -63,8 +72,12 @@ class _SuperportAppState extends State<SuperportApp> {
     if (GetIt.I.isRegistered<PermissionManager>()) {
       GetIt.I.unregister<PermissionManager>();
     }
+    if (GetIt.I.isRegistered<MenuCatalog>()) {
+      GetIt.I.unregister<MenuCatalog>();
+    }
     _themeController.dispose();
     _permissionManager.dispose();
+    _menuCatalog.dispose();
     super.dispose();
   }
 
@@ -72,26 +85,32 @@ class _SuperportAppState extends State<SuperportApp> {
   Widget build(BuildContext context) {
     return PermissionScope(
       manager: _permissionManager,
-      child: ThemeControllerScope(
-        controller: _themeController,
-        child: AnimatedBuilder(
-          animation: _themeController,
-          builder: (context, _) {
-            return ShadApp.router(
-              title: 'Superport v2',
-              routerConfig: appRouter,
-              debugShowCheckedModeBanner: false,
-              supportedLocales: const [Locale('ko', 'KR'), Locale('en', 'US')],
-              localizationsDelegates: const [
-                GlobalMaterialLocalizations.delegate,
-                GlobalWidgetsLocalizations.delegate,
-                GlobalCupertinoLocalizations.delegate,
-              ],
-              theme: SuperportShadTheme.light(),
-              darkTheme: SuperportShadTheme.dark(),
-              themeMode: _themeController.mode,
-            );
-          },
+      child: MenuCatalogScope(
+        catalog: _menuCatalog,
+        child: ThemeControllerScope(
+          controller: _themeController,
+          child: AnimatedBuilder(
+            animation: _themeController,
+            builder: (context, _) {
+              return ShadApp.router(
+                title: 'Superport v2',
+                routerConfig: appRouter,
+                debugShowCheckedModeBanner: false,
+                supportedLocales: const [
+                  Locale('ko', 'KR'),
+                  Locale('en', 'US'),
+                ],
+                localizationsDelegates: const [
+                  GlobalMaterialLocalizations.delegate,
+                  GlobalWidgetsLocalizations.delegate,
+                  GlobalCupertinoLocalizations.delegate,
+                ],
+                theme: SuperportShadTheme.light(),
+                darkTheme: SuperportShadTheme.dark(),
+                themeMode: _themeController.mode,
+              );
+            },
+          ),
         ),
       ),
     );
@@ -107,7 +126,17 @@ class _SuperportAppState extends State<SuperportApp> {
       manager: _permissionManager,
       groupRepository: GetIt.I<GroupRepository>(),
       groupPermissionRepository: GetIt.I<GroupPermissionRepository>(),
+      menuCatalog: _menuCatalog,
     );
     await bootstrapper.apply(session);
   }
+
+  Future<void> _preloadMenus() async {
+    try {
+      await _menuCatalog.refresh();
+    } catch (error, stackTrace) {
+      debugPrint('메뉴 목록 초기화 실패: $error');
+      debugPrintStack(stackTrace: stackTrace);
+    }
+  }
 }