Add role-based access control with admin/editor roles

Create adminOnly and adminOrEditor access functions. Add role field
to Users collection (admin/editor, default: editor). Update access control
across all collections and globals to enforce role-based permissions.

apps/backend/src/access/adminOrEditor.ts

@@ -0,0 +1,14 @@
+import type { Access } from 'payload'
+
+/**
+ * 允許 Admin 或 Editor 角色訪問
+ *
+ * 用例：
+ * - Posts/Pages collection (內容管理)
+ * - Categories collection (內容分類)
+ * - Portfolio collection (作品管理)
+ */
+export const adminOrEditor: Access = ({ req: { user } }) => {
+  if (!user) return false
+  return user?.role === 'admin' || user?.role === 'editor'
+}