Phase 7 UI and access cleanup hotfix

Included changes:
- grouped sidebar navigation with collapsible submenus
- role-based controller access via Router + helper access map
- improved account management
- faculty profile fields inside account form
- reset-password action (default password: password)

No database schema change is required if you already imported the Phase 7 schema.