Use React-Admin access control features

Since v5.3, React-Admin offer access control features that can work on a per-record level.

https://marmelab.com/react-admin/Permissions.html#access-control

So we could implement the `canAccess` method in the auth provider.

> Great news! By popular request, we open-sourced the advanced Access Control feature, previously exclusive to our Enterprise Edition. Access control is now an opt-in feature for react-admin 5.3. To enable it, you just need to implement a new authProvider method called [canAccess](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeG13DjoSVq07iLR1Vy9T/sIcv-wyoaOK7).
>
>When access control is enabled, all react-admin page components ([List](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeG7ufsdPh09boAjlUGjj/rJbDw_GYvG_Y), [Create](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeGEm81SMsAJ5u02VSZJz/EqTzwW2iHNMk), [Edit](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeGLdaAHK3KSZzpLFQruF/zXxHKiykSoMF) and [Show](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeGSV2J6HEUc45edzPAUV/scxtNFZ7hdQ6)) will show an "Access Denied" message to unauthorized users.
>
> The action buttons ([EditButton](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeGZMURvEPelYBTwjNT4l/ICG6hfCzwOkI), [CreateButton](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeGgDwakBaov2HJFTLlf1/-DuTnk-lA7Xf), [DeleteButton](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeGn5OjZ8lz4WN8YDK4FH/c1f2k4_iUgZY), [ShowButton](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/SMK1E8tHeGtwqsO5x9E0SxqxIMpX/m7ns4lbIeCd-), and [ListButton](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/1t6Af4OiGsDhYHblpJ2fkkR8a9gKhv/fsCeIGQtbfnI)) as well as the [Menu item](https://5pgg5.r.sp1-brevo.net/mk/cl/f/sh/1t6Af4OiGsE9szoCDf8av0Uxxyf4Pz/1R4NfsauI6N0) component also have built-in access control. They are only displayed if the user can access the corresponding action on the resource.
>
>Under the hood, the addition of Access Control primitives imposed a partial rewrite of the security layer of react-admin. As a consequence, all the authentication and authorization checks are now pessimistic, and users will never see a page skeleton or a button for which they don't have access rights.
>
> In other terms, with react-admin 5.3, apps are more secure by default.

Start with the linked React-Admin Permissions documentation, then locate the application's auth provider and inspect how authentication and authorization checks are integrated. The work is complete when the auth provider implements canAccess and the relevant pages, action buttons, and menu items enforce the documented access decisions.

Written by the indexing model from the issue text.