fix(permissions): remove direct user permission sync — roles only

UpdateUserAction and CreateUserAction were calling syncPermissions()
which wrote to model_has_permissions table directly. This meant
permissions persisted even after being removed from the role.

Now users only get permissions through their roles.

app/Containers/Dashboard/Actions/Users/CreateUserAction.php

@@ -19,11 +19,6 @@ class CreateUserAction
             $user->syncRoles($data['roles']);
         }
 
-        // Назначение разрешений если переданы
-        if (isset($data['permissions']) && is_array($data['permissions'])) {
-            $user->syncPermissions($data['permissions']);
-        }
-
         return $user->load(['roles', 'permissions']);
     }
 

app/Containers/Dashboard/Actions/Users/UpdateUserAction.php

@@ -19,9 +19,8 @@ class UpdateUserAction
             unset($data['password']);
         }
 
-        // Извлекаем роли и пермисшены — они не в $fillable и не колонки таблицы
+        // Извлекаем роли — они не в $fillable и не колонки таблицы
         $roles = $data['roles'] ?? null;
-        $permissions = $data['permissions'] ?? null;
         unset($data['roles'], $data['permissions']);
 
         $user->update($data);
@@ -31,11 +30,6 @@ class UpdateUserAction
             $user->syncRoles($roles);
         }
 
-        // Синхронизация разрешений
-        if ($permissions !== null && is_array($permissions)) {
-            $user->syncPermissions($permissions);
-        }
-
         return $user->fresh(['roles', 'permissions']);
     }