feat(dashboard): role-specific tile filtering + server-driven module ordering (E11.S03)

[abdout]

Story: E11.S03 (Phase 1 Pilot v1, Sprint P3)
Epic: EPIC-PROD-11 Dashboard & Navigation
Points: 5

Problem

Every role sees every home-grid tile today. A STUDENT shouldn't see the Students roster, AtomStudio (dev-only), or teacher-side Assignments marking; a GUARDIAN shouldn't see admin/dev tiles; an ADMIN shouldn't see AtomStudio. Mirroring the hogwarts platform-sidebar matrix is the AC.

Fix

Introduces two small dashboard-local primitives following the atomic/reusability doctrine:

• HomeTileId — stable enum identifier per tile + serverName that mirrors the hogwarts module taxonomy (src/components/template/platform-sidebar/config.ts)
• HomeTileVisibility — Map<UserRole, Set<HomeTileId>> honouring the AC matrix
• List<HomeTileSpec>.filterAndOrderForRole(role, enabledModules) — extension that (a) filters by role visibility, then (b) reorders by the server enabledModules manifest with stable fallback ordering for unknown tiles

HomeTileSpec gains an id: HomeTileId field so every tile carries its identifier. DashboardUiState.enabledModules: List<String> lands as the server hand-off point (populated by /api/mobile/dashboard once E08.S06 ships; defaults to empty list so the dashboard is fully usable today).

Role matrix (current 5-role enum)

• STUDENT — Grades, Fees, Stream, Subjects, Settings, Notifications, Exams, Library, Events, Profile, Attendance, Schedule, Messages, Announcements
• TEACHER — same + Students + Assignments, − Fees
• GUARDIAN — Grades, Fees, Settings, Notifications, Events, Profile, Attendance, Schedule, Messages, Announcements
• ADMIN — all − AtomStudio
• SUPER_ADMIN — all (≈ server DEVELOPER)

Acceptance criteria

• HomeTileSpec carries a stable id: HomeTileId
• STUDENT view excludes Students roster, Assignments, AtomStudio
• TEACHER view includes Students + Assignments, excludes Fees + AtomStudio
• GUARDIAN view = child-scoped subset (no roster, no marking, no dev tools)
• ADMIN excludes only AtomStudio
• When enabledModules is empty, default per-role order is preserved
• When enabledModules is non-empty, matching tiles lead in server order; unknown tiles follow in default order
• 9 unit tests cover the matrix + ordering rules

Atomic / reusability notes

• HomeTileId + HomeTileVisibility are dashboard-local primitives (not lifted to core/designsystem — they encode a dashboard-specific contract). They follow the same shape as other dashboard primitives (HomeTileSpec, HomeDockItem).
• Filter + order is a pure extension on List<HomeTileSpec> — composable with any future grid that uses the same spec list shape.

Deferred / forward-compat

• UserRole only carries 5 values today; the server returns 8 (DEVELOPER, ADMIN, TEACHER, STUDENT, GUARDIAN, ACCOUNTANT, STAFF, USER). Mapping in HomeTileVisibility is structured so E02.S01 (8-role expansion) only adds entries; existing entries don't change. Once E02.S01 lands, add ACCOUNTANT, STAFF, USER sets and rename SUPER_ADMIN → DEVELOPER.
• enabledModules is server-driven (E08.S06); until that endpoint ships, the dashboard uses role defaults. No degradation.

Coexistence

Stacks cleanly on top of PR #13 (E11.S01 tile wiring) — same file edited but disjoint lines. If E11.S01 merges first, this PR rebases automatically; if this one merges first, E11.S01 needs to re-add id = HomeTileId.X to its 4 wired tiles.

Refs: .bmad/epics/epic-prod-11-dashboard-navigation.md, .bmad/epics/epic-prod-02-multi-tenancy-rbac.md (E02.S01 dependency), hogwarts src/components/template/platform-sidebar/config.ts.