fix(config): re-sync employee permissions on role change; add sync script

pos/blueprints/config_bp.py

@@ -486,6 +486,15 @@ def update_employee(emp_id):
     params.append(emp_id)
     cur.execute(f"UPDATE employees SET {', '.join(updates)} WHERE id = %s", params)
 
+    # If the role changed, re-sync permissions to match the new role defaults/config.
+    if 'role' in data:
+        cur.execute("DELETE FROM employee_permissions WHERE employee_id = %s", (emp_id,))
+        for perm in _get_role_permissions(conn, data['role']):
+            cur.execute(
+                "INSERT INTO employee_permissions (employee_id, permission) VALUES (%s, %s) ON CONFLICT DO NOTHING",
+                (emp_id, perm)
+            )
+
     from services.audit import log_action
     log_action(conn, 'EMPLOYEE_UPDATE', 'employee', emp_id,
                new_value={k: v for k, v in data.items() if k != 'pin'})