feat: implement LMS core (CMS, Courses, Enrollment, Progress, Auth) (Admin + API)

apps/common/api/permissions.py

@@ -0,0 +1,12 @@
+from rest_framework.permissions import BasePermission, SAFE_METHODS
+
+class IsStaffOrReadOnly(BasePermission):
+    """
+    - อ่านได้ทุกคน
+    - เขียนได้เฉพาะ staff
+    """
+
+    def has_permission(self, request, view):
+        if request.method in SAFE_METHODS:
+            return True
+        return request.user and request.user.is_staff