Feat 308 email template admin access

[mohammadsherif0]

Description

Fixes #308: after admin is removed, a user who still owns email templates (types 1/2/3/6/7) could view/edit/save them without a hard refresh. Email template actions now re-check admin, and the rights cache refreshes when rolesUpdatedAt changes.

Please review #333 first: it already restricts public list/view to importable types (4/5) for non-admins; this PR continues that policy for owned email templates and for mid-session demotion.

Improvements

• Email getContent / editContent / closeTemplate / updateFromSource deny non-admins (owners included).
• expandBroadcastFilter only tracks sources for importable copies (types 4/5), so non-admins are not subscribed to email sources.
• getUserRolesById ignores soft-deleted role rows.
• User.cache.clear() after role updates so findByPk sees the new rolesUpdatedAt.
• isAdmin / hasAccess compare DB rolesUpdatedAt (ms) to the cached stamp and reload when it changes.
• Cache both allowed and denied rights (!== undefined), so a deny is not looked up again every time.

Idea / open question

Can all Socket subclasses on one connection share a single rights cache? Right now each keeps its own userInfo.