fix: Bug fixed für Rollen

ApiCore-Backend/src/auth/permissions/permission-catalog-sync.service.ts

@@ -9,6 +9,14 @@ import { PERMISSION_CATALOG } from './permission-catalog';
  * catalog entry missing from the database. Never deletes a Permission row
  * that fell out of the catalog (only warns) — a role's grants must not
  * silently disappear because of a typo or a reordered catalog edit.
+ *
+ * Every newly-synced permission is also granted to every `isSystem` role
+ * (ADMIN's seed row documents itself as "Voller Zugriff auf alle Bereiche" -
+ * full access to every area). Without this, a role that legitimately means
+ * "everything" would silently lose that guarantee each time a new feature
+ * ships a new permission, forcing a manual grant in Rollen & Rechte before
+ * the feature is usable at all - exactly the gap that made the freshly
+ * shipped Etiketten feature invisible to the seeded admin account.
  */
 @Injectable()
 export class PermissionCatalogSyncService implements OnModuleInit {
@@ -25,15 +33,34 @@ export class PermissionCatalogSyncService implements OnModuleInit {
     const missing = PERMISSION_CATALOG.filter(
       (entry) => !existingKeys.has(entry.key),
     );
-    for (const entry of missing) {
-      await this.prisma.permission.create({ data: entry });
-    }
+    const createdPermissions = await Promise.all(
+      missing.map((entry) => this.prisma.permission.create({ data: entry })),
+    );
     if (missing.length > 0) {
       this.logger.log(
         `Synced ${missing.length} new permission(s) from the code catalog: ${missing
           .map((entry) => entry.key)
           .join(', ')}`,
       );
+
+      const systemRoles = await this.prisma.role.findMany({
+        where: { isSystem: true },
+        select: { id: true },
+      });
+      if (systemRoles.length > 0) {
+        await this.prisma.rolePermission.createMany({
+          data: systemRoles.flatMap((role) =>
+            createdPermissions.map((permission) => ({
+              roleId: role.id,
+              permissionId: permission.id,
+            })),
+          ),
+          skipDuplicates: true,
+        });
+        this.logger.log(
+          `Granted ${missing.length} new permission(s) to ${systemRoles.length} system role(s).`,
+        );
+      }
     }
 
     const catalogKeys = new Set(PERMISSION_CATALOG.map((entry) => entry.key));