security: Add proper authentication, RBAC, and tenant isolation

- Add password hashing with bcrypt
- Add AuthService with proper login
- Add password strength validation
- Add RBAC middleware (AdminOnly, ManagerOrAdmin)
- Add tenant isolation middleware
- Update CRM handler with tenant filtering
- Add JWT fallback for development mode
- Add user context helpers
- Build successful

backend/middleware/rbac.go

@@ -0,0 +1,46 @@
+package middleware
+
+import (
+	"net/http"
+
+	"boc/auth"
+)
+
+// RBAC middleware kontrollerar att användaren har minst en av de tillåtna rollerna
+func RBAC(allowedRoles ...string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			claims, ok := auth.FromContext(r.Context())
+			if !ok {
+				writeError(w, http.StatusUnauthorized, "unauthorized")
+				return
+			}
+
+			// Kontrollera om användaren har någon av de tillåtna rollerna
+			hasRole := false
+			for _, role := range allowedRoles {
+				if claims.HasRole(role) {
+					hasRole = true
+					break
+				}
+			}
+
+			if !hasRole {
+				writeError(w, http.StatusForbidden, "forbidden: insufficient permissions")
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// AdminOnly middleware - endast admin-roll tillåten
+func AdminOnly(next http.Handler) http.Handler {
+	return RBAC("admin")(next)
+}
+
+// ManagerOrAdmin middleware - manager eller admin
+func ManagerOrAdmin(next http.Handler) http.Handler {
+	return RBAC("admin", "manager")(next)
+}