feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

static/shared/js/api-client.js

@@ -471,7 +471,7 @@ const Auth = {
      */
     isAdmin() {
         const user = this.getCurrentUser();
-        const isAdmin = user && user.role === 'admin';
+        const isAdmin = user && ['super_admin', 'platform_admin'].includes(user.role);
         apiLog.debug('Admin check:', isAdmin ? 'is admin' : 'not admin');
         return isAdmin;
     },
@@ -487,7 +487,7 @@ const Auth = {
         });
 
         // Store token and user
-        if (response.user.role === 'admin') {
+        if (['super_admin', 'platform_admin'].includes(response.user.role)) {
             apiLog.info('Storing admin credentials');
             localStorage.setItem('admin_token', response.access_token);
             localStorage.setItem('admin_user', JSON.stringify(response.user));
@@ -579,4 +579,4 @@ if (document.readyState === 'loading') {
     initTableScrollDetection();
 }
 
-apiLog.info('API Client module loaded');
+apiLog.info('API Client module loaded');