feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/core/static/admin/js/init-alpine.js

@@ -175,7 +175,7 @@ function data() {
     adminProfile: getAdminProfileFromStorage(),
 
     get isSuperAdmin() {
-      return this.adminProfile?.is_super_admin === true;
+      return this.adminProfile?.role === 'super_admin';
     },
 
     // ─────────────────────────────────────────────────────────────────
@@ -398,4 +398,4 @@ const PlatformSettings = {
 };
 
 // Export to window
-window.PlatformSettings = PlatformSettings;
+window.PlatformSettings = PlatformSettings;

app/modules/core/static/admin/js/login.js

@@ -147,7 +147,7 @@ function adminLogin() {
                     throw new Error('Invalid response from server - no token');
                 }
 
-                if (response.user && response.user.role !== 'admin') {
+                if (response.user && !['super_admin', 'platform_admin'].includes(response.user.role)) {
                     loginLog.error('Authorization failed: User is not admin', {
                         actualRole: response.user.role
                     });
@@ -166,8 +166,7 @@ function adminLogin() {
                     loginLog.debug('User data stored:', {
                         username: response.user.username,
                         role: response.user.role,
-                        id: response.user.id,
-                        is_super_admin: response.user.is_super_admin
+                        id: response.user.id
                     });
                 }
 
@@ -243,4 +242,4 @@ function adminLogin() {
     }
 }
 
-loginLog.info('Login module loaded');
+loginLog.info('Login module loaded');