feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/static/admin/js/admin-users.js

@@ -22,7 +22,7 @@ function adminUsersPage() {
         adminToDelete: null,
         filters: {
             search: '',
-            is_super_admin: '',
+            role: '',
             is_active: ''
         },
         stats: {
@@ -143,7 +143,7 @@ function adminUsersPage() {
                 if (this.filters.search) {
                     params.append('search', this.filters.search);
                 }
-                if (this.filters.is_super_admin === 'false') {
+                if (this.filters.role === 'platform_admin') {
                     params.append('include_super_admins', 'false');
                 }
                 if (this.filters.is_active !== '') {
@@ -174,9 +174,11 @@ function adminUsersPage() {
                     );
                 }
 
-                // Filter by super admin status
-                if (this.filters.is_super_admin === 'true') {
-                    admins = admins.filter(admin => admin.is_super_admin);
+                // Filter by role
+                if (this.filters.role === 'super_admin') {
+                    admins = admins.filter(admin => admin.role === 'super_admin');
+                } else if (this.filters.role === 'platform_admin') {
+                    admins = admins.filter(admin => admin.role === 'platform_admin');
                 }
 
                 // Filter by active status
@@ -227,8 +229,8 @@ function adminUsersPage() {
                 // Compute stats from the data
                 this.stats = {
                     total_admins: admins.length,
-                    super_admins: admins.filter(a => a.is_super_admin).length,
-                    platform_admins: admins.filter(a => !a.is_super_admin).length,
+                    super_admins: admins.filter(a => a.role === 'super_admin').length,
+                    platform_admins: admins.filter(a => a.role === 'platform_admin').length,
                     active_admins: admins.filter(a => a.is_active).length
                 };