feat: RBAC Phase 1 — consolidate user roles into 4-value enum

Consolidate User.role (2-value: admin/store) + User.is_super_admin (boolean)
into a single 4-value UserRole enum: super_admin, platform_admin,
merchant_owner, store_member. Drop stale StoreUser.user_type column.
Fix role="user" bug in merchant creation.

Key changes:
- Expand UserRole enum from 2 to 4 values with computed properties
  (is_admin, is_super_admin, is_platform_admin, is_merchant_owner, is_store_user)
- Add Alembic migration (tenancy_003) for data migration + column drops
- Remove is_super_admin from JWT token payload
- Update all auth dependencies, services, routes, templates, JS, and tests
- Update all RBAC documentation

66 files changed, 1219 unit tests passing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/integration/api/v1/store/test_dashboard.py

@@ -73,7 +73,7 @@ class TestStoreDashboardAPI:
             email=f"orphan_{uuid.uuid4().hex[:8]}@example.com",
             username=f"orphanstore_{uuid.uuid4().hex[:8]}",
             hashed_password=hashed_password,
-            role="store",
+            role="merchant_owner",
             is_active=True,
         )
         db.add(orphan_user)
@@ -111,11 +111,10 @@ class TestStoreDashboardAPI:
         db.add(store)
         db.commit()
 
-        # Associate with user as owner
+        # Associate with user (ownership determined via Merchant.owner_user_id)
         store_user = StoreUser(
             store_id=store.id,
             user_id=test_store_user.id,
-            user_type="owner",
             is_active=True,
         )
         db.add(store_user)