- Added comprehensive permission checks in perform_create()
- Created _check_item_edit_permission() helper method
- Updated perform_update() and perform_destroy() to use helper
- Permission logic now matches CanManageProcurementRequest:
* Admins/Staff can edit items in DRAFT requests
* Users with change_procurementrequest permission
* Request author can edit their own requests
* Department head can edit requests from their department
- Fixes 403 Forbidden error when creating/editing/deleting items
Игорь Надеин
978ed9a819