feat: add approval ui for join requests

lib/mv/authorization/permission_sets.ex

@@ -218,7 +218,11 @@ defmodule Mv.Authorization.PermissionSets do
             perm("MembershipFeeCycle", :update, :all),
             perm("MembershipFeeCycle", :destroy, :all)
           ] ++
-          role_read_all(),
+          role_read_all() ++
+          [
+            perm("JoinRequest", :read, :all),
+            perm("JoinRequest", :update, :all)
+          ],
       pages: [
         "/",
         # Own profile (sidebar links to /users/:id; redirect target must be allowed)
@@ -247,7 +251,10 @@ defmodule Mv.Authorization.PermissionSets do
         # Edit group
         "/groups/:slug/edit",
         # Statistics
-        "/statistics"
+        "/statistics",
+        # Approval UI (Step 2)
+        "/join_requests",
+        "/join_requests/:id"
       ]
     }
   end
@@ -270,7 +277,8 @@ defmodule Mv.Authorization.PermissionSets do
           perm_all("Group") ++
           member_group_perms ++
           perm_all("MembershipFeeType") ++
-          perm_all("MembershipFeeCycle"),
+          perm_all("MembershipFeeCycle") ++
+          perm_all("JoinRequest"),
       pages: [
         # Explicit admin-only pages (for clarity and future restrictions)
         "/settings",