feat(menu-permissions): 메뉴 API 연동으로 사이드바 권한 정비

- .env.development.example과 lib/core/config/environment.dart, lib/core/permissions/permission_manager.dart에서 PERMISSION__ 폴백을 view 전용으로 좁히고 기본 정책을 명시적으로 거부하도록 재정비했다

- lib/core/navigation/*, lib/core/routing/app_router.dart, lib/widgets/app_shell.dart, lib/main.dart에서 메뉴 매니페스트·카탈로그를 도입해 /menus 응답을 캐싱하고 라우터·사이드바·Breadcrumb가 동일 menu_code/route_path를 쓰도록 리팩터링했다

- lib/core/permissions/permission_resources.dart와 그룹 권한/메뉴 마스터 모듈을 menu_code 기반 CRUD 및 Catalog 경로 정합성 검사로 전환하고 PermissionSynchronizer·PermissionBootstrapper를 확장했다

- test/helpers/test_permissions.dart, test/widgets/app_shell_test.dart 등 신규 구조를 반영하는 테스트·골든과 doc/frontend_menu_permission_tasks.md 문서를 보강했다

test/widgets/app_shell_test.dart

@@ -6,7 +6,8 @@ import 'package:lucide_icons_flutter/lucide_icons.dart' as lucide;
 import 'package:shadcn_ui/shadcn_ui.dart';
 
 import 'package:superport_v2/core/common/models/paginated_result.dart';
-import 'package:superport_v2/core/constants/app_sections.dart';
+import 'package:superport_v2/core/navigation/menu_catalog.dart';
+import 'package:superport_v2/core/navigation/route_paths.dart';
 import 'package:superport_v2/core/permissions/permission_manager.dart';
 import 'package:superport_v2/core/theme/superport_shad_theme.dart';
 import 'package:superport_v2/core/theme/theme_controller.dart';
@@ -17,6 +18,8 @@ import 'package:superport_v2/features/auth/domain/entities/auth_session.dart';
 import 'package:superport_v2/features/auth/domain/entities/authenticated_user.dart';
 import 'package:superport_v2/features/auth/domain/entities/login_request.dart';
 import 'package:superport_v2/features/auth/domain/repositories/auth_repository.dart';
+import 'package:superport_v2/features/masters/menu/domain/entities/menu.dart';
+import 'package:superport_v2/features/masters/menu/domain/repositories/menu_repository.dart';
 import 'package:superport_v2/features/masters/user/domain/entities/user.dart';
 import 'package:superport_v2/features/masters/user/domain/repositories/user_repository.dart';
 import 'package:superport_v2/widgets/app_shell.dart';
@@ -209,6 +212,15 @@ void main() {
 Future<void> _pumpAppShell(WidgetTester tester) async {
   final themeController = ThemeController();
   final permissionManager = PermissionManager();
+  if (!GetIt.I.isRegistered<MenuRepository>()) {
+    GetIt.I.registerSingleton<MenuRepository>(_StubMenuRepository());
+  }
+  final menuCatalog = MenuCatalog(repository: GetIt.I<MenuRepository>());
+  await menuCatalog.refresh();
+  if (GetIt.I.isRegistered<MenuCatalog>()) {
+    GetIt.I.unregister<MenuCatalog>();
+  }
+  GetIt.I.registerSingleton<MenuCatalog>(menuCatalog);
   final router = GoRouter(
     initialLocation: dashboardRoutePath,
     routes: [
@@ -231,18 +243,22 @@ Future<void> _pumpAppShell(WidgetTester tester) async {
 
   addTearDown(themeController.dispose);
   addTearDown(permissionManager.dispose);
+  addTearDown(menuCatalog.dispose);
   addTearDown(router.dispose);
 
   await tester.pumpWidget(
     PermissionScope(
       manager: permissionManager,
-      child: ThemeControllerScope(
-        controller: themeController,
-        child: ShadApp.router(
-          routerConfig: router,
-          theme: SuperportShadTheme.light(),
-          darkTheme: SuperportShadTheme.dark(),
-          debugShowCheckedModeBanner: false,
+      child: MenuCatalogScope(
+        catalog: menuCatalog,
+        child: ThemeControllerScope(
+          controller: themeController,
+          child: ShadApp.router(
+            routerConfig: router,
+            theme: SuperportShadTheme.light(),
+            darkTheme: SuperportShadTheme.dark(),
+            debugShowCheckedModeBanner: false,
+          ),
         ),
       ),
     ),
@@ -289,6 +305,66 @@ class _FakeAuthRepository implements AuthRepository {
   Future<AuthSession> refresh(String refreshToken) async => session;
 }
 
+class _StubMenuRepository implements MenuRepository {
+  @override
+  Future<MenuItem> create(MenuInput input) {
+    throw UnimplementedError();
+  }
+
+  @override
+  Future<void> delete(int id) {
+    throw UnimplementedError();
+  }
+
+  @override
+  Future<PaginatedResult<MenuItem>> list({
+    int page = 1,
+    int pageSize = 20,
+    String? query,
+    int? parentId,
+    bool? isActive,
+    bool includeDeleted = false,
+  }) async {
+    return PaginatedResult<MenuItem>(
+      items: [
+        MenuItem(
+          id: 1,
+          menuCode: 'dashboard',
+          menuName: '대시보드',
+          path: dashboardRoutePath,
+          displayOrder: 10,
+        ),
+        MenuItem(
+          id: 2,
+          menuCode: 'inventory.receipts',
+          menuName: '입고',
+          path: inventoryReceiptsRoutePath,
+          displayOrder: 20,
+          parent: MenuSummary(
+            id: 10,
+            menuName: '재고',
+            menuCode: 'inventory',
+            path: inventorySummaryRoutePath,
+          ),
+        ),
+      ],
+      page: 1,
+      pageSize: 2,
+      total: 2,
+    );
+  }
+
+  @override
+  Future<MenuItem> restore(int id) {
+    throw UnimplementedError();
+  }
+
+  @override
+  Future<MenuItem> update(int id, MenuInput input) {
+    throw UnimplementedError();
+  }
+}
+
 class _MemoryTokenStorage implements TokenStorage {
   String? _access;
   String? _refresh;