feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/services/tenancy_metrics.py

@@ -216,7 +216,7 @@ class TenancyMetricsProvider:
                 db.query(User)
                 .filter(
                     User.id.in_(platform_user_ids),
-                    User.role == "admin",
+                    User.role.in_(["super_admin", "platform_admin"]),
                 )
                 .count()
             )
@@ -230,11 +230,9 @@ class TenancyMetricsProvider:
             )
 
             # Team members: distinct StoreUser users who are NOT merchant owners
-            # Uses user_type="member" AND excludes owner user IDs to avoid overlap
             team_members = (
                 db.query(func.count(func.distinct(StoreUser.user_id)))
                 .filter(
-                    StoreUser.user_type == "member",
                     ~StoreUser.user_id.in_(db.query(Merchant.owner_user_id)),
                 )
                 .scalar() or 0