feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/static/admin/js/user-create.js

@@ -17,7 +17,7 @@ function adminUserCreate() {
             password: '',
             first_name: '',
             last_name: '',
-            is_super_admin: false,
+            role: 'platform_admin',
             platform_ids: []
         },
         platforms: [],
@@ -72,7 +72,7 @@ function adminUserCreate() {
             }
 
             // Platform admin validation: must have at least one platform
-            if (!this.formData.is_super_admin) {
+            if (this.formData.role !== 'super_admin') {
                 if (!this.formData.platform_ids || this.formData.platform_ids.length === 0) {
                     this.errors.platform_ids = 'Platform admins must be assigned to at least one platform';
                 }
@@ -103,8 +103,8 @@ function adminUserCreate() {
                     password: this.formData.password,
                     first_name: this.formData.first_name || null,
                     last_name: this.formData.last_name || null,
-                    is_super_admin: this.formData.is_super_admin,
-                    platform_ids: this.formData.is_super_admin ? [] : this.formData.platform_ids.map(id => parseInt(id))
+                    role: this.formData.role,
+                    platform_ids: this.formData.role === 'super_admin' ? [] : this.formData.platform_ids.map(id => parseInt(id))
                 };
 
                 window.LogConfig.logApiCall('POST', url, { ...payload, password: '[REDACTED]' }, 'request');
@@ -116,7 +116,7 @@ function adminUserCreate() {
                 window.LogConfig.logApiCall('POST', url, response, 'response');
                 window.LogConfig.logPerformance('Create Admin User', duration);
 
-                const userType = this.formData.is_super_admin ? 'Super admin' : 'Platform admin';
+                const userType = this.formData.role === 'super_admin' ? 'Super admin' : 'Platform admin';
                 Utils.showToast(`${userType} created successfully`, 'success');
                 userCreateLog.info(`${userType} created successfully in ${duration}ms`, response);