feat: Implement file management and authorization features

- Add RequiresPermissionAttribute for gRPC method access control.
- Create IFileManagementService interface for file upload and management.
- Implement AddProductImageCommand and handler for adding product images.
- Implement CreateNewProductsCommand and handler for creating new products with image uploads.
- Implement DeleteProductsCommand and handler for deleting products and their associations.
- Implement RemoveProductImageCommand and handler for removing product images from galleries.
- Implement UpdateProductsCommand and handler for updating product details and images.
- Create GetProductGalleryQuery and handler for retrieving product galleries.
- Implement PermissionService for role-based access control using JWT claims.
- Implement FileManagementService for handling file uploads and image optimization.
- Define gRPC service and messages for file management in fms.proto.
- Add FluentValidation for request validation in various commands.
- Create PermissionInterceptor for enforcing permissions on gRPC methods.

src/CMSMicroservice.Application/Common/Authorization/IPermissionService.cs

@@ -0,0 +1,17 @@
+namespace CMSMicroservice.Application.Common.Authorization;
+
+/// <summary>
+/// سرویس بررسی مجوز کاربر بر اساس نقش‌های JWT
+/// </summary>
+public interface IPermissionService
+{
+    /// <summary>
+    /// دریافت نقش‌های کاربر فعلی از JWT Claims
+    /// </summary>
+    Task<IReadOnlyList<string>> GetUserRolesAsync(CancellationToken cancellationToken);
+
+    /// <summary>
+    /// بررسی اینکه آیا کاربر فعلی مجوز مشخصی دارد
+    /// </summary>
+    Task<bool> HasPermissionAsync(string permission, CancellationToken cancellationToken);
+}

src/CMSMicroservice.Application/Common/Authorization/PermissionDefinitions.cs

@@ -0,0 +1,127 @@
+namespace CMSMicroservice.Application.Common.Authorization;
+
+/// <summary>
+/// ثوابت نام مجوزها — دسته‌بندی شده بر اساس حوزه
+/// </summary>
+public static class PermissionNames
+{
+    // Dashboard
+    public const string DashboardView = "dashboard.view";
+
+    // Orders
+    public const string OrdersView = "orders.view";
+    public const string OrdersCreate = "orders.create";
+    public const string OrdersUpdate = "orders.update";
+    public const string OrdersDelete = "orders.delete";
+    public const string OrdersCancel = "orders.cancel";
+    public const string OrdersApprove = "orders.approve";
+
+    // Products
+    public const string ProductsView = "products.view";
+    public const string ProductsCreate = "products.create";
+    public const string ProductsUpdate = "products.update";
+    public const string ProductsDelete = "products.delete";
+
+    // Users
+    public const string UsersView = "users.view";
+    public const string UsersUpdate = "users.update";
+    public const string UsersDelete = "users.delete";
+
+    // Commission
+    public const string CommissionView = "commission.view";
+    public const string CommissionApproveWithdrawal = "commission.approve_withdrawal";
+
+    // Public Messages
+    public const string PublicMessagesView = "publicmessages.view";
+    public const string PublicMessagesCreate = "publicmessages.create";
+    public const string PublicMessagesUpdate = "publicmessages.update";
+    public const string PublicMessagesPublish = "publicmessages.publish";
+
+    // Manual Payments
+    public const string ManualPaymentsView = "manualpayments.view";
+    public const string ManualPaymentsCreate = "manualpayments.create";
+    public const string ManualPaymentsApprove = "manualpayments.approve";
+
+    // Settings
+    public const string SettingsView = "settings.view";
+    public const string SettingsUpdate = "settings.update";
+    public const string SettingsDelete = "settings.delete";
+    public const string SettingsManageConfiguration = "settings.manage_configuration";
+    public const string SettingsManageVat = "settings.manage_vat";
+
+    // Reports
+    public const string ReportsView = "reports.view";
+}
+
+/// <summary>
+/// نام نقش‌ها
+/// </summary>
+public static class RoleNames
+{
+    public const string SuperAdmin = "Administrator";
+    public const string Admin = "Admin";
+    public const string Inspector = "Inspector";
+}
+
+/// <summary>
+/// تنظیمات نقش→مجوز — ماتریس دسترسی
+/// </summary>
+public static class RolePermissionConfig
+{
+    private static readonly Dictionary<string, HashSet<string>> RolePermissions = new(StringComparer.OrdinalIgnoreCase)
+    {
+        [RoleNames.SuperAdmin] = new(StringComparer.OrdinalIgnoreCase) { "*" }, // Full access
+
+        [RoleNames.Admin] = new(StringComparer.OrdinalIgnoreCase)
+        {
+            PermissionNames.DashboardView,
+            PermissionNames.OrdersView,
+            PermissionNames.OrdersCreate,
+            PermissionNames.OrdersUpdate,
+            PermissionNames.OrdersCancel,
+            PermissionNames.ProductsView,
+            PermissionNames.ProductsCreate,
+            PermissionNames.ProductsUpdate,
+            PermissionNames.ProductsDelete,
+            PermissionNames.UsersView,
+            PermissionNames.UsersUpdate,
+            PermissionNames.CommissionView,
+            PermissionNames.CommissionApproveWithdrawal,
+            PermissionNames.PublicMessagesView,
+            PermissionNames.PublicMessagesCreate,
+            PermissionNames.PublicMessagesUpdate,
+            PermissionNames.PublicMessagesPublish,
+            PermissionNames.ManualPaymentsView,
+            PermissionNames.ManualPaymentsCreate,
+            PermissionNames.ReportsView
+        },
+
+        [RoleNames.Inspector] = new(StringComparer.OrdinalIgnoreCase)
+        {
+            PermissionNames.DashboardView,
+            PermissionNames.OrdersView,
+            PermissionNames.UsersView,
+            PermissionNames.CommissionView,
+            PermissionNames.PublicMessagesView,
+            PermissionNames.ReportsView
+        }
+    };
+
+    /// <summary>
+    /// بررسی اینکه آیا نقش مشخصی مجوز خاصی دارد
+    /// </summary>
+    public static bool HasPermission(string role, string permission)
+    {
+        if (string.IsNullOrWhiteSpace(role) || string.IsNullOrWhiteSpace(permission))
+            return false;
+
+        if (!RolePermissions.TryGetValue(role, out var permissions))
+            return false;
+
+        // Wildcard: SuperAdmin has full access
+        if (permissions.Contains("*"))
+            return true;
+
+        return permissions.Contains(permission);
+    }
+}

src/CMSMicroservice.Application/Common/Authorization/RequiresPermissionAttribute.cs

@@ -0,0 +1,15 @@
+namespace CMSMicroservice.Application.Common.Authorization;
+
+/// <summary>
+/// Attribute برای مشخص کردن مجوز لازم برای دسترسی به یک متد gRPC
+/// </summary>
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
+public sealed class RequiresPermissionAttribute : Attribute
+{
+    public RequiresPermissionAttribute(string permission)
+    {
+        Permission = permission ?? throw new ArgumentNullException(nameof(permission));
+    }
+
+    public string Permission { get; }
+}

src/CMSMicroservice.Application/Common/Interfaces/IFileManagementService.cs

@@ -0,0 +1,37 @@
+namespace CMSMicroservice.Application.Common.Interfaces;
+
+/// <summary>
+/// Service for uploading files to FMS (File Management Service)
+/// </summary>
+public interface IFileManagementService
+{
+    /// <summary>
+    /// Uploads a file to FMS and returns the stored file path
+    /// </summary>
+    /// <param name="directory">Target directory path (e.g. "Images/Products")</param>
+    /// <param name="fileBytes">Raw file bytes</param>
+    /// <param name="mime">MIME type (e.g. "image/jpeg")</param>
+    /// <param name="fileName">Original file name</param>
+    /// <param name="cancellationToken">Cancellation token</param>
+    /// <returns>The stored file path returned by FMS, or null if upload failed</returns>
+    Task<string?> UploadFileAsync(string directory, byte[] fileBytes, string mime, string? fileName, CancellationToken cancellationToken = default);
+    
+    /// <summary>
+    /// Uploads an image to FMS with optimization (resize + compress)
+    /// Returns both main image path and thumbnail path
+    /// </summary>
+    /// <param name="directory">Target directory path (e.g. "Images/Products")</param>
+    /// <param name="fileBytes">Raw image bytes</param>
+    /// <param name="mime">MIME type (e.g. "image/jpeg")</param>
+    /// <param name="fileName">Original file name</param>
+    /// <param name="cancellationToken">Cancellation token</param>
+    /// <returns>Tuple of (mainImagePath, thumbnailPath), either can be null if upload failed</returns>
+    Task<(string? MainImagePath, string? ThumbnailPath)> UploadImageWithThumbnailAsync(
+        string directory, byte[] fileBytes, string mime, string? fileName, 
+        CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Deletes a file from FMS by its ID
+    /// </summary>
+    Task<bool> DeleteFileAsync(long fileId, CancellationToken cancellationToken = default);
+}