Roles

Roles

RBAC baseline: owner, admin, operator, reviewer, viewer.

Role assignments are backed by `roles` + `user_roles` and enforced in `/api/admin/*` routes.