feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/services/admin_service.py

@@ -69,7 +69,7 @@ class AdminService:
             raise CannotModifySelfException(user_id, "deactivate account")
 
         # Check if user is another admin
-        if user.role == "admin" and user.id != current_admin_id:
+        if user.is_admin and user.id != current_admin_id:
             raise UserStatusChangeException(
                 user_id=user_id,
                 current_status="admin",
@@ -248,7 +248,7 @@ class AdminService:
         user = self._get_user_by_id_or_raise(db, user_id)
 
         # Prevent changing own admin status
-        if user.id == current_admin_id and role and role != "admin":
+        if user.id == current_admin_id and role and role not in ("super_admin", "platform_admin"):
             raise UserRoleChangeException(
                 user_id=user_id,
                 current_role=user.role,