Why: Non-root managers need the system-management entry and controls to follow their explicit grants. Evidence: The full Backend test suite passed and /api/me action projection is covered by the grant-isolation test. Impact: /api/me now returns only the current actor system actions evaluated by the same authorizer. Refs: Focused role and permission system task 7