Feat: Implement Role-Based Access Control (RBAC) and Protected Routes

@Git-brintsi20 is already working on this.

Since Jul 30, 2025.

Hey @manishkumar8312

### Description
The application currently has a significant security and architectural gap in its Role-Based Access Control (RBAC) and route protection, both on the frontend and backend.

### Problem Areas

**1. Backend: No Way to Create a 'hotelOwner'**
- The `User` model has a `role` field defaulting to `'user'`.
- The Clerk webhook (`user.created`) only creates users with this default role.
- There is currently no backend logic or endpoint for an administrator to assign or for a user to become a `'hotelOwner'`.

**2. Frontend: Lack of Protected Routes**
- In `App.jsx`, routes like `/my-bookings` and the entire `/owner` layout are rendered without checking if the user is authenticated. A user who is not logged in can access these routes, leading to errors or empty pages.
- Furthermore, a regular user (role: `'user'`) can directly navigate to `/owner` and see the owner's dashboard layout, which is a security flaw.

### Proposed Solution

This requires a two-part implementation:

**Part 1: Backend RBAC Foundation**
- Create a new, admin-only API endpoint (e.g., `POST /api/users/:userId/role`) that allows an existing admin to update a user's role to `'hotelOwner'`.
- This endpoint must be protected by middleware that verifies the request is coming from a user who is already an admin.

**Part 2: Frontend Route Protection**
- Create a `` component.
- This component will wrap protected routes in `App.jsx`. It should:
1. Check for an active Clerk session. If no user is logged in, redirect to the home page (where the login modal is).
2. For owner-specific routes, it should also check if `user.publicMetadata.role === 'hotelOwner'`. If not, redirect the user away.

This is a foundational feature for the application's security and integrity. I would be happy to take on this task.