iKOOP Commission Management System - UPDATE v3.0
================================================

MAJOR UPDATE: Organized menu + Role & Permission Management (RBAC)

UPGRADE FROM
------------
Designed to upgrade an existing iKOOP v2.5 installation.

BEFORE UPDATING
---------------
1. Back up the full iKOOP website folder.
2. Export/backup the iKOOP MySQL database.
3. Keep config/database.php and storage/installed.lock.

INSTALL UPDATE
--------------
1. Upload iKOOP-UPDATE-v3.0-RBAC-Menu.zip into the existing iKOOP document root.
2. Extract and choose Overwrite / Replace existing files.
3. DO NOT delete config/database.php.
4. DO NOT delete storage/installed.lock.
5. Refresh/login to iKOOP. The v3.0 database migration runs automatically once.
6. Sign in as SUPERADMIN and open Administration > Roles & Permissions.

WHAT CHANGES
------------
- Sidebar is reorganized into:
  Dashboard
  Work Queue
  Projects
  People
  Finance
  Forms
  Administration
- Change Password is moved from the sidebar to the user menu in the top-right.
- New Roles & Permissions screen.
- Create custom roles without coding.
- Tick/untick permissions for menus and actions.
- Per-user Permission Override is available for exceptions.
- Sidebar items are automatically hidden when the user has no permission.
- Backend actions are also permission-protected; hiding a menu is not the only security layer.
- SUPERADMIN remains the master role and cannot be restricted.

MIGRATION OF EXISTING USERS
---------------------------
Existing users are automatically mapped to the new built-in roles:
- SUPERADMIN -> Super Admin
- ADMIN      -> Admin
- OPERATOR   -> Operator
- VIEWER     -> Viewer

The initial permission sets preserve the previous access behavior as closely as possible.
You can change the built-in Admin / Operator / Viewer permission matrix after the update.

CUSTOM ROLE EXAMPLE
-------------------
Administration > Roles & Permissions > Create Custom Role
Example: "Finance Executive"
- Start with Admin, Operator, Viewer, or Blank permissions.
- Then tick only the menus/actions required.

USER-SPECIFIC OVERRIDE
----------------------
Administration > Users > choose a user > Permission Override
For each permission choose:
- Inherit from role
- Allow
- Deny

Recommendation: use roles for normal access and user overrides only for special cases.

IMPORTANT
---------
The permission system can control existing iKOOP features without code changes.
A completely new future module still has to be built in code once; after its permissions exist, access can be managed from the permission matrix.

PHP
---
Test target: PHP 8.4.
