feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/static/admin/js/admin-user-edit.js

@@ -101,7 +101,7 @@ function adminUserEditPage() {
                 adminUserEditLog.info(`Admin user loaded in ${duration}ms`, {
                     id: this.adminUser.id,
                     username: this.adminUser.username,
-                    is_super_admin: this.adminUser.is_super_admin
+                    role: this.adminUser.role
                 });
 
             } catch (error) {
@@ -128,7 +128,7 @@ function adminUserEditPage() {
 
         // Get available platforms (not yet assigned)
         get availablePlatformsForAssignment() {
-            if (!this.adminUser || this.adminUser.is_super_admin) return [];
+            if (!this.adminUser || this.adminUser.role === 'super_admin') return [];
             const assignedIds = (this.adminUser.platforms || []).map(p => p.id);
             return this.platforms.filter(p => !assignedIds.includes(p.id));
         },
@@ -143,12 +143,13 @@ function adminUserEditPage() {
 
         // Toggle super admin status
         async toggleSuperAdmin() {
-            const newStatus = !this.adminUser.is_super_admin;
-            const action = newStatus ? 'promote to' : 'demote from';
+            const isSuperAdmin = this.adminUser.role === 'super_admin';
+            const newRole = isSuperAdmin ? 'platform_admin' : 'super_admin';
+            const action = !isSuperAdmin ? 'promote to' : 'demote from';
             adminUserEditLog.info(`Toggle super admin: ${action}`);
 
             // Prevent self-demotion
-            if (this.adminUser.id === this.currentUserId && !newStatus) {
+            if (this.adminUser.id === this.currentUserId && isSuperAdmin) {
                 Utils.showToast(I18n.t('tenancy.messages.you_cannot_demote_yourself_from_super_ad'), 'error');
                 return;
             }
@@ -156,19 +157,19 @@ function adminUserEditPage() {
             this.saving = true;
             try {
                 const url = `/admin/admin-users/${this.userId}/super-admin`;
-                window.LogConfig.logApiCall('PUT', url, { is_super_admin: newStatus }, 'request');
+                window.LogConfig.logApiCall('PUT', url, { role: newRole }, 'request');
 
-                const response = await apiClient.put(url, { is_super_admin: newStatus });
+                const response = await apiClient.put(url, { role: newRole });
 
                 window.LogConfig.logApiCall('PUT', url, response, 'response');
 
-                this.adminUser.is_super_admin = response.is_super_admin;
+                this.adminUser.role = response.role;
                 // Clear platforms if promoted to super admin
-                if (response.is_super_admin) {
+                if (response.role === 'super_admin') {
                     this.adminUser.platforms = [];
                 }
 
-                const actionDone = newStatus ? 'promoted to' : 'demoted from';
+                const actionDone = newRole === 'super_admin' ? 'promoted to' : 'demoted from';
                 Utils.showToast(`Admin ${actionDone} super admin successfully`, 'success');
                 adminUserEditLog.info(`Admin ${actionDone} super admin successfully`);