feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/integration/api/v1/admin/test_admin_users.py

@@ -54,7 +54,7 @@ class TestAdminUsersListAPI:
         data = response.json()
         # All returned admins should not be super admins
         for admin in data["admins"]:
-            assert admin["is_super_admin"] is False
+            assert admin["role"] != "super_admin"
 
 
 @pytest.mark.integration
@@ -84,7 +84,7 @@ class TestAdminUsersCreateAPI:
         data = response.json()
         assert data["email"] == "new_platform_admin@example.com"
         assert data["username"] == "new_platform_admin"
-        assert data["is_super_admin"] is False
+        assert data["role"] == "platform_admin"
         assert len(data["platform_assignments"]) == 2
 
     def test_create_platform_admin_duplicate_email(
@@ -208,13 +208,13 @@ class TestAdminUsersSuperAdminToggleAPI:
         """Test promoting a platform admin to super admin."""
         response = client.put(
             f"/api/v1/admin/admin-users/{test_platform_admin.id}/super-admin",
-            json={"is_super_admin": True},
+            json={"role": "super_admin"},
             headers=super_admin_headers,
         )
 
         assert response.status_code == 200
         data = response.json()
-        assert data["is_super_admin"] is True
+        assert data["role"] == "super_admin"
 
     def test_demote_from_super_admin(
         self, client, super_admin_headers, db, auth_manager
@@ -227,22 +227,21 @@ class TestAdminUsersSuperAdminToggleAPI:
             email="demote_test@example.com",
             username="demote_test",
             hashed_password=auth_manager.hash_password("pass"),
-            role="admin",
+            role="super_admin",
             is_active=True,
-            is_super_admin=True,
         )
         db.add(another_super)
         db.commit()
 
         response = client.put(
             f"/api/v1/admin/admin-users/{another_super.id}/super-admin",
-            json={"is_super_admin": False},
+            json={"role": "platform_admin"},
             headers=super_admin_headers,
         )
 
         assert response.status_code == 200
         data = response.json()
-        assert data["is_super_admin"] is False
+        assert data["role"] == "platform_admin"
 
 
 @pytest.mark.integration