Roles via Nextcloud groups: sms-admin/manager/viewer + fix OAuth instance_uri

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Models/User.php

@@ -7,10 +7,11 @@ use Filament\Panel;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use Spatie\Permission\Traits\HasRoles;
 
 class User extends Authenticatable implements FilamentUser
 {
-    use HasFactory, Notifiable;
+    use HasFactory, Notifiable, HasRoles;
 
     /**
      * The attributes that are mass assignable.
@@ -48,6 +49,6 @@ class User extends Authenticatable implements FilamentUser
 
     public function canAccessPanel(Panel $panel): bool
     {
-        return true; // allow all authenticated users access to the dashboard
+        return $this->hasAnyRole(['sms-admin', 'sms-manager', 'sms-viewer']);
     }
 }