feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/marketplace/services/marketplace_import_job_service.py

@@ -87,7 +87,7 @@ class MarketplaceImportJobService:
                 raise ImportJobNotFoundException(job_id)
 
             # Users can only see their own jobs, admins can see all
-            if user.role != "admin" and job.user_id != user.id:
+            if not user.is_admin and job.user_id != user.id:
                 raise ImportJobNotOwnedException(job_id, user.id)
 
             return job
@@ -160,7 +160,7 @@ class MarketplaceImportJobService:
             )
 
             # Users can only see their own jobs, admins can see all store jobs
-            if user.role != "admin":
+            if not user.is_admin:
                 query = query.filter(MarketplaceImportJob.user_id == user.id)
 
             # Apply marketplace filter

app/modules/marketplace/services/platform_signup_service.py

@@ -38,8 +38,6 @@ from app.modules.tenancy.models import (
     Platform,
     Store,
     StorePlatform,
-    StoreUser,
-    StoreUserType,
     User,
 )
 from middleware.auth import AuthManager
@@ -338,7 +336,7 @@ class PlatformSignupService:
             hashed_password=self.auth_manager.hash_password(password),
             first_name=first_name,
             last_name=last_name,
-            role="store",
+            role="merchant_owner",
             is_active=True,
         )
         db.add(user)
@@ -373,14 +371,7 @@ class PlatformSignupService:
         db.add(store)
         db.flush()
 
-        # Create StoreUser (owner)
-        store_user = StoreUser(
-            store_id=store.id,
-            user_id=user.id,
-            user_type=StoreUserType.OWNER.value,
-            is_active=True,
-        )
-        db.add(store_user)
+        # Owner relationship is via Merchant.owner_user_id — no StoreUser needed
 
         # Create StoreOnboarding record
         onboarding_service = OnboardingService(db)