fix(rbac): replace dashboard super-admin-only access with dashboard.view permission

src/modules/dashboard/dashboard.controller.ts

@@ -1,15 +1,15 @@
 import { Controller, Get, Query, UseGuards } from '@nestjs/common';
 import { DashboardService } from './dashboard.service';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
-import { RequireSuperAdmin } from '../rbac/decorators/require-permission.decorator';
+import { RequirePermission } from '../rbac/decorators/require-permission.decorator';
 import {
   DashboardDataDto,
   DashboardTrendsDto,
 } from './dto/dashboard-overview.dto';
 
 @Controller('dashboard')
 @UseGuards(JwtAuthGuard)
-@RequireSuperAdmin()
+@RequirePermission('dashboard.view')
 export class DashboardController {
   constructor(private readonly dashboardService: DashboardService) {}
 

src/modules/rbac/constants/permission-catalog.ts

@@ -35,7 +35,8 @@ export type PermissionCode =
   | 'servers.control'
   | 'servers.config'
   | 'servers.disconnect'
-  | 'servers.ban';
+  | 'servers.ban'
+  | 'dashboard.view';
 
 export type SystemPermissionCode =
   'roles.create' | 'roles.edit' | 'roles.delete';
@@ -281,6 +282,7 @@ export const PERMISSION_CATALOG: readonly PermissionDefinition[] = [
     'roles.view',
     'users.view',
   ]),
+  definition('dashboard.view', 'dashboard', 'view', 'View dashboard'),
 ];
 
 export const PERMISSION_CODES: readonly PermissionCode[] =

src/modules/rbac/rbac-authorization.service.spec.ts

@@ -1156,10 +1156,13 @@ describe('RbacAuditService', () => {
     );
   });
 
-  it('keeps global dashboard aggregates super-administrator-only', () => {
+  it('requires dashboard.view permission instead of super-administrator', () => {
     expect(
       Reflect.getMetadata(REQUIRE_SUPER_ADMIN_KEY, DashboardController),
-    ).toBe(true);
+    ).toBeUndefined();
+    expect(
+      Reflect.getMetadata(REQUIRE_PERMISSION_KEY, DashboardController),
+    ).toEqual(['dashboard.view']);
   });
 
   it('separates delegated role viewing/assignment from owner-only definitions', () => {