Major Enhancement: NestJS Migration + CASL Authorization + Error Handling

Complete rewrite from Express to NestJS with enterprise-grade features:

## Backend Improvements
- Migrated from Express to NestJS 11.0.1 with TypeScript
- Implemented Prisma ORM 7.3.0 for type-safe database access
- Added CASL authorization system replacing role-based guards
- Created global exception filters with structured logging
- Implemented Auth0 JWT authentication with Passport.js
- Added vehicle management with conflict detection
- Enhanced event scheduling with driver/vehicle assignment
- Comprehensive error handling and logging

## Frontend Improvements
- Upgraded to React 19.2.0 with Vite 7.2.4
- Implemented CASL-based permission system
- Added AbilityContext for declarative permissions
- Created ErrorHandler utility for consistent error messages
- Enhanced API client with request/response logging
- Added War Room (Command Center) dashboard
- Created VIP Schedule view with complete itineraries
- Implemented Vehicle Management UI
- Added mock data generators for testing (288 events across 20 VIPs)

## New Features
- Vehicle fleet management (types, capacity, status tracking)
- Complete 3-day Jamboree schedule generation
- Individual VIP schedule pages with PDF export (planned)
- Real-time War Room dashboard with auto-refresh
- Permission-based navigation filtering
- First user auto-approval as administrator

## Documentation
- Created CASL_AUTHORIZATION.md (comprehensive guide)
- Created ERROR_HANDLING.md (error handling patterns)
- Updated CLAUDE.md with new architecture
- Added migration guides and best practices

## Technical Debt Resolved
- Removed custom authentication in favor of Auth0
- Replaced role checks with CASL abilities
- Standardized error responses across API
- Implemented proper TypeScript typing
- Added comprehensive logging

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

backend/src/auth/guards/abilities.guard.ts

@@ -0,0 +1,64 @@
+import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AbilityFactory, Action, Subjects } from '../abilities/ability.factory';
+
+/**
+ * Interface for required permissions
+ */
+export interface RequiredPermission {
+  action: Action;
+  subject: Subjects;
+}
+
+/**
+ * Metadata key for permissions
+ */
+export const CHECK_ABILITY = 'check_ability';
+
+/**
+ * Guard that checks CASL abilities
+ */
+@Injectable()
+export class AbilitiesGuard implements CanActivate {
+  constructor(
+    private reflector: Reflector,
+    private abilityFactory: AbilityFactory,
+  ) {}
+
+  async canActivate(context: ExecutionContext): boolean {
+    const requiredPermissions =
+      this.reflector.get<RequiredPermission[]>(
+        CHECK_ABILITY,
+        context.getHandler(),
+      ) || [];
+
+    // If no permissions required, allow access
+    if (requiredPermissions.length === 0) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+
+    // User should be attached by JwtAuthGuard
+    if (!user) {
+      throw new ForbiddenException('User not authenticated');
+    }
+
+    // Build abilities for user
+    const ability = this.abilityFactory.defineAbilitiesFor(user);
+
+    // Check if user has all required permissions
+    const hasPermission = requiredPermissions.every((permission) =>
+      ability.can(permission.action, permission.subject),
+    );
+
+    if (!hasPermission) {
+      throw new ForbiddenException(
+        `User does not have required permissions`,
+      );
+    }
+
+    return true;
+  }
+}