…k-end layer

Implements issue #386 (MDL-01a, API-01a, BE-01a) covering the full vertical slice
for unit management: shared library models, API operation definitions, and the
complete back-end controller/service/datastore stack.

## Shared library (edifikana/shared)
- Add `UnitModel` — client-facing domain model with all unit fields
- Add `GetUnitsQueryParams` — query params (org_id, optional property_id) for the
  list-units endpoint

## API contract (edifikana/api)
- Add `UnitApi` — defines five typed operations:
  createUnit (POST), getUnit (GET /{id}), getUnits (GET ?org_id=&property_id=),
  updateUnit (PUT /{id}), deleteUnit (DELETE /{id})

## Back-end server (edifikana/back-end)
### Domain / persistence layer
- Add `Unit` service model (mirrors DB schema, includes `createdAt`)
- Add `UnitEntity` + `CreateUnitEntity` Supabase entity with soft-delete support
- Add `UnitDatastore` interface (createUnit, getUnit, getUnits, updateUnit, deleteUnit)
- Add `SupabaseUnitDatastore` implementation:
  - Queries filter `deleted_at IS NULL` (soft-delete pattern)
  - updateUnit uses partial PATCH via `UnitEntity.CreateUnitEntity`
  - deleteUnit sets `deleted_at = clock.now()` instead of hard-deleting
- Add mapper functions in `SupabaseMappers`: `CreateUnitEntity(...)` factory and
  `UnitEntity.toUnit()` extension

### Service layer
- Add `UnitService` — thin delegation to `UnitDatastore` with `.getOrThrow()` /
  `.getOrNull()` unwrapping

### Controller layer
- Add `UnitController` with RBAC gates per endpoint:
  - createUnit → MANAGER or higher (scoped to org)
  - getUnit    → EMPLOYEE or higher (scoped to unit → org lookup)
  - getUnits   → EMPLOYEE or higher (scoped to org)
  - updateUnit → MANAGER or higher (scoped to unit → org lookup)
  - deleteUnit → ADMIN or higher (scoped to unit → org lookup)
- Add `Unit.toUnitNetworkResponse()` mapper in `NetworkMappers`

### Authorization
- Extend `RBACService` with `UnitId`-scoped `hasRole` / `hasRoleOrHigher` overloads;
  looks up the unit's `orgId` via `UnitDatastore` and delegates to the existing
  org-level role check (same pattern as DocumentId / PropertyId)
- Add `unitDatastore: UnitDatastore` constructor parameter to `RBACService`

### Dependency injection
- Register `SupabaseUnitDatastore` → `UnitDatastore` in `DatastoreModule`
- Register `UnitService` in `ServicesModule`
- Register `UnitController` as `Controller` in `ControllerModule`

## Tests
- Add `UnitControllerTest` — 10 tests covering success and auth-failure paths for
  all five CRUD operations using MockK + Koin test harness
- Add JSON fixture files for all request/response bodies
- Update `TestModule`: add `UnitController` to `TestControllerModule` and mock
  `UnitService` in `TestServiceModule`
- Fix `RBACServiceTest`: pass new `unitDatastore` mock to `RBACService` constructor

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>