fix(render+roles): batch smooth shading + step timings + global_admin role support

Render pipeline:
- Replace per-object _apply_smooth() loop with _apply_smooth_batch(): selects
  all 175 parts, calls shade_smooth_by_angle() ONCE in C → reduces 16s to ~0.2s
- Remove 175 per-part "assigned material to part" log lines (replace with summary)
- Add TIMING_SUMMARY log line at end of every render showing all step durations
- _lap() helper records split times for: template_load, glb_import, rotation,
  smooth_shading, material_assign, pre_render_setup, gpu_render

Frontend role checks:
- Add global_admin + tenant_admin to User role type in auth store
- Add isAdmin() and isPrivileged() helper functions
- Fix Admin.tsx, Layout.tsx, Notifications.tsx, OrderDetail.tsx, ProductDetail.tsx,
  CostOverviewWidget.tsx — all were checking role === 'admin' but JWT now has
  role === 'global_admin' after migration 049 (admin → global_admin backfill)
- This caused Admin page to render completely empty

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/dashboard/widgets/CostOverviewWidget.tsx

@@ -1,7 +1,7 @@
 import { useQuery } from '@tanstack/react-query'
 import { DollarSign, FileText } from 'lucide-react'
 import api from '../../../api/client'
-import { useAuthStore } from '../../../store/auth'
+import { useAuthStore, isAdmin as checkIsAdmin, isPrivileged as checkIsPrivileged } from '../../../store/auth'
 
 interface Invoice {
   id: string
@@ -27,7 +27,7 @@ function Skeleton() {
 export default function CostOverviewWidget() {
   const user = useAuthStore((s) => s.user)
   const isPrivileged =
-    user?.role === 'admin' || user?.role === 'project_manager'
+    checkIsPrivileged(user)
 
   const { data, isLoading, error } = useQuery<Invoice[]>({
     queryKey: ['invoices-widget'],

frontend/src/components/layout/Layout.tsx

@@ -1,6 +1,6 @@
 import { Outlet, NavLink, useNavigate, Link } from 'react-router-dom'
 import { LayoutDashboard, Package, Settings, LogOut, FlaskConical, Activity, Library, Plus, SlidersHorizontal, Building2, GitBranch, Image, BellRing, Receipt, Server, Upload, Menu, X } from 'lucide-react'
-import { useAuthStore } from '../../store/auth'
+import { useAuthStore, isAdmin as checkIsAdmin, isPrivileged as checkIsPrivileged } from '../../store/auth'
 import { clsx } from 'clsx'
 import { useState } from 'react'
 import { useQuery } from '@tanstack/react-query'
@@ -148,7 +148,7 @@ export default function Layout() {
             )
           })}
 
-          {(user?.role === 'admin' || user?.role === 'project_manager') && (
+          {(checkIsPrivileged(user)) && (
             <NavLink
               to="/admin"
               onClick={() => setSidebarOpen(false)}
@@ -165,7 +165,7 @@ export default function Layout() {
               Admin
             </NavLink>
           )}
-          {(user?.role === 'admin' || user?.role === 'project_manager') && (
+          {(checkIsPrivileged(user)) && (
             <NavLink
               to="/billing"
               onClick={() => setSidebarOpen(false)}
@@ -182,7 +182,7 @@ export default function Layout() {
               Billing
             </NavLink>
           )}
-          {(user?.role === 'admin' || user?.role === 'project_manager') && (
+          {(checkIsPrivileged(user)) && (
             <NavLink
               to="/media"
               onClick={() => setSidebarOpen(false)}
@@ -199,7 +199,7 @@ export default function Layout() {
               Media Browser
             </NavLink>
           )}
-          {(user?.role === 'admin' || user?.role === 'project_manager') && (
+          {(checkIsPrivileged(user)) && (
             <NavLink
               to="/workers"
               onClick={() => setSidebarOpen(false)}
@@ -216,7 +216,7 @@ export default function Layout() {
               Workers
             </NavLink>
           )}
-          {(user?.role === 'admin' || user?.role === 'project_manager') && (
+          {(checkIsPrivileged(user)) && (
             <NavLink
               to="/workflows"
               onClick={() => setSidebarOpen(false)}
@@ -233,7 +233,7 @@ export default function Layout() {
               Workflows
             </NavLink>
           )}
-          {(user?.role === 'admin' || user?.role === 'project_manager') && (
+          {(checkIsPrivileged(user)) && (
             <NavLink
               to="/asset-libraries"
               onClick={() => setSidebarOpen(false)}
@@ -250,7 +250,7 @@ export default function Layout() {
               Asset Libraries
             </NavLink>
           )}
-          {user?.role === 'admin' && (
+          {checkIsAdmin(user) && (
             <NavLink
               to="/notification-settings"
               onClick={() => setSidebarOpen(false)}
@@ -267,7 +267,7 @@ export default function Layout() {
               Notification Settings
             </NavLink>
           )}
-          {user?.role === 'admin' && (
+          {checkIsAdmin(user) && (
             <NavLink
               to="/tenants"
               onClick={() => setSidebarOpen(false)}