feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/tests/unit/test_user_model.py

@@ -18,7 +18,7 @@ class TestUserModel:
             email="db_test@example.com",
             username="dbtest",
             hashed_password="hashed_password_123",  # noqa: SEC001
-            role="user",
+            role="store_member",
             is_active=True,
         )
 
@@ -29,7 +29,7 @@ class TestUserModel:
         assert user.id is not None
         assert user.email == "db_test@example.com"
         assert user.username == "dbtest"
-        assert user.role == "user"
+        assert user.role == "store_member"
         assert user.is_active is True
         assert user.created_at is not None
         assert user.updated_at is not None
@@ -86,7 +86,7 @@ class TestUserModel:
         db.refresh(user)
 
         assert user.is_active is True  # Default
-        assert user.role == "store"  # Default (UserRole.STORE)
+        assert user.role == "store_member"  # Default (UserRole.STORE_MEMBER)
 
     def test_user_optional_fields(self, db):
         """Test User model with optional fields."""