1. Remove double <aside> wrapper (app.blade.php was wrapping sidebar in
   its own aside, conflicting with sidebar's own fixed positioning)
2. Replace auth()->user()->can() with PermissionService->can() which
   properly handles is_super_admin bypass
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>