Permission system and Inventory manager

Moved all business logic to the api/services dir