feat(backend): Complete Phase 2.5 - Access Control Implementation

Implement comprehensive permission-based access control system with share management.

Features:
- Permission model (Read, Write, Admin)
- Share model for resource sharing between users
- Permission middleware for endpoint protection
- Share management API endpoints
- Permission check endpoints
- MongoDB repository implementations for all models

Files Added:
- backend/src/db/permission.rs - Permission repository
- backend/src/db/share.rs - Share repository
- backend/src/db/user.rs - User repository
- backend/src/db/profile.rs - Profile repository
- backend/src/db/appointment.rs - Appointment repository
- backend/src/db/family.rs - Family repository
- backend/src/db/health_data.rs - Health data repository
- backend/src/db/lab_result.rs - Lab results repository
- backend/src/db/medication.rs - Medication repository
- backend/src/db/mongodb_impl.rs - MongoDB trait implementations
- backend/src/handlers/permissions.rs - Permission API handlers
- backend/src/handlers/shares.rs - Share management handlers
- backend/src/middleware/permission.rs - Permission checking middleware

API Endpoints:
- GET /api/permissions/check - Check user permissions
- POST /api/shares - Create new share
- GET /api/shares - List user shares
- GET /api/shares/:id - Get specific share
- PUT /api/shares/:id - Update share
- DELETE /api/shares/:id - Delete share

Status: Phase 2.5 COMPLETE - Building successfully, ready for production

backend/src/handlers/permissions.rs

@@ -0,0 +1,58 @@
+use axum::{
+    extract::{Query, State},
+    http::StatusCode,
+    response::IntoResponse,
+    Json,
+    Extension,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    auth::jwt::Claims,
+    config::AppState,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct CheckPermissionQuery {
+    pub resource_type: String,
+    pub resource_id: String,
+    pub permission: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct PermissionCheckResponse {
+    pub has_permission: bool,
+    pub resource_type: String,
+    pub resource_id: String,
+    pub permission: String,
+}
+
+pub async fn check_permission(
+    State(state): State<AppState>,
+    Query(params): Query<CheckPermissionQuery>,
+    Extension(claims): Extension<Claims>,
+) -> impl IntoResponse {
+    let has_permission = match state.db.check_user_permission(
+        &claims.sub,
+        &params.resource_type,
+        &params.resource_id,
+        &params.permission,
+    ).await {
+        Ok(result) => result,
+        Err(e) => {
+            tracing::error!("Failed to check permission: {}", e);
+            return (StatusCode::INTERNAL_SERVER_ERROR, Json(serde_json::json!({
+                "error": "failed to check permission"
+            }))).into_response();
+        }
+    };
+    
+    let response = PermissionCheckResponse {
+        has_permission,
+        resource_type: params.resource_type,
+        resource_id: params.resource_id,
+        permission: params.permission,
+    };
+    
+    (StatusCode::OK, Json(response)).into_response()
+}