feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/services/store_team_service.py

@@ -33,7 +33,7 @@ from app.modules.tenancy.exceptions import (
     TeamMemberAlreadyExistsException,
     UserNotFoundException,
 )
-from app.modules.tenancy.models import Role, Store, StoreUser, StoreUserType, User
+from app.modules.tenancy.models import Role, Store, StoreUser, User
 from middleware.auth import AuthManager
 
 logger = logging.getLogger(__name__)
@@ -134,7 +134,7 @@ class StoreTeamService:
                     email=email,
                     username=username,
                     hashed_password=self.auth_manager.hash_password(temp_password),
-                    role="store",  # Platform role
+                    role="store_member",
                     is_active=False,  # Will be activated when invitation accepted
                     is_email_verified=False,
                 )
@@ -157,7 +157,6 @@ class StoreTeamService:
             store_user = StoreUser(
                 store_id=store.id,
                 user_id=user.id,
-                user_type=StoreUserType.TEAM_MEMBER.value,
                 role_id=role.id,
                 invited_by=inviter.id,
                 invitation_token=invitation_token,
@@ -416,7 +415,6 @@ class StoreTeamService:
                     "first_name": vu.user.first_name,
                     "last_name": vu.user.last_name,
                     "full_name": vu.user.full_name,
-                    "user_type": vu.user_type,
                     "role_name": vu.role.name if vu.role else "owner",
                     "role_id": vu.role.id if vu.role else None,
                     "permissions": vu.get_all_permissions(),