feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/services/store_service.py

@@ -80,7 +80,7 @@ class StoreService:
 
             # Check if user is merchant owner or admin
             if (
-                current_user.role != "admin"
+                not current_user.is_admin
                 and merchant.owner_user_id != current_user.id
             ):
                 raise UnauthorizedStoreAccessException(
@@ -105,7 +105,7 @@ class StoreService:
                 letzshop_csv_url_en=store_data.letzshop_csv_url_en,
                 letzshop_csv_url_de=store_data.letzshop_csv_url_de,
                 is_active=True,
-                is_verified=(current_user.role == "admin"),
+                is_verified=current_user.is_admin,
             )
 
             db.add(new_store)
@@ -153,7 +153,7 @@ class StoreService:
             query = db.query(Store)
 
             # Non-admin users can only see active and verified stores, plus their own
-            if current_user.role != "admin":
+            if not current_user.is_admin:
                 # Get store IDs the user owns through merchants
                 from app.modules.tenancy.models import Merchant
 
@@ -457,7 +457,7 @@ class StoreService:
     def _can_access_store(self, store: Store, user: User) -> bool:
         """Check if user can access store."""
         # Admins can always access
-        if user.role == "admin":
+        if user.is_admin:
             return True
 
         # Merchant owners can access their stores
@@ -481,7 +481,7 @@ class StoreService:
         - Team members with appropriate role (owner role in StoreUser)
         """
         # Admins can always update
-        if user.role == "admin":
+        if user.is_admin:
             return True
 
         # Check if user is store owner via merchant