feat: allow regular users to view their own tenant's org chart

Changes the /users endpoint to allow RoleUser access and securely restricts the returned data to only users within their affiliated tenants. Removes the unnecessary back button from the Org Chart view since it's now a top-level nav item.

backend/cmd/server/main.go

@@ -599,13 +599,17 @@ func main() {
 		KetoService:  ketoService,
 	})
 	requireAdmin := middleware.RequireRole(middleware.RBACConfig{
-		AllowedRoles: []string{domain.RoleSuperAdmin, domain.RoleTenantAdmin},
-		AuthHandler:  authHandler,
-		KetoService:  ketoService,
+	        AllowedRoles: []string{domain.RoleSuperAdmin, domain.RoleTenantAdmin},
+	        AuthHandler:  authHandler,
+	        KetoService:  ketoService,
+	})
+	requireAnyUser := middleware.RequireRole(middleware.RBACConfig{
+	        AllowedRoles: []string{domain.RoleSuperAdmin, domain.RoleTenantAdmin, domain.RoleRPAdmin, domain.RoleUser},
+	        AuthHandler:  authHandler,
+	        KetoService:  ketoService,
 	})
 
-	admin.Get("/check", adminHandler.CheckAuth) // 기본 Admin 체크는 requireAdmin 없이 ApiKeyAuth로만 보호될 수 있음 (또는 추가 가능)
-	admin.Get("/stats", requireSuperAdmin, adminHandler.GetSystemStats)
+	admin.Get("/check", adminHandler.CheckAuth) // 기본 Admin 체크는 requireAdmin 없이 ApiKeyAuth로만 보호될 수 있음 (또는 추가 가능)	admin.Get("/stats", requireSuperAdmin, adminHandler.GetSystemStats)
 
 	// Tenant Management (Mixed roles, handler filters results)
 	admin.Get("/tenants", requireAdmin, tenantHandler.ListTenants)
@@ -668,9 +672,8 @@ func main() {
 		relyingPartyHandler.Delete)
 
 	// Admin User Management
-	admin.Get("/users", requireAdmin, userHandler.ListUsers)
-	admin.Get("/users/export", userHandler.ExportUsersCSV) // Removed requireAdmin to handle mock role in query param
-	admin.Post("/users", requireAdmin, userHandler.CreateUser)
+	admin.Get("/users", requireAnyUser, userHandler.ListUsers)
+	admin.Get("/users/export", userHandler.ExportUsersCSV) // Removed requireAdmin to handle mock role in query param	admin.Post("/users", requireAdmin, userHandler.CreateUser)
 	admin.Post("/users/bulk", requireAdmin, userHandler.BulkCreateUsers)
 	admin.Put("/users/bulk", requireAdmin, userHandler.BulkUpdateUsers)
 	admin.Delete("/users/bulk", requireAdmin, userHandler.BulkDeleteUsers)