feat: implement complete RBAC access control with tests

Add 4-layer access control stack (subscription → module → menu → permissions):
- P1: Wire requires_permission into menu sidebar filtering
- P2: Expose window.USER_PERMISSIONS for Alpine.js client-side gating
- P3: Add page-level permission guards on store routes
- P4: Role CRUD API endpoints and role editor UI
- P5: Audit trail for all role/permission changes

Includes unit tests (menu permission filtering, role CRUD service) and
integration tests (role API endpoints). All 404 core+tenancy tests pass.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/routes/pages/store.py

@@ -19,6 +19,7 @@ from app.api.deps import (
     get_current_store_optional,
     get_db,
     get_resolved_store_code,
+    require_store_page_permission,
 )
 from app.modules.core.utils.page_context import get_store_context
 from app.modules.tenancy.models import User
@@ -90,7 +91,7 @@ async def store_login_page(
 async def store_team_page(
     request: Request,
     store_code: str = Depends(get_resolved_store_code),
-    current_user: User = Depends(get_current_store_from_cookie_or_header),
+    current_user: User = Depends(require_store_page_permission("team.view")),
     db: Session = Depends(get_db),
 ):
     """
@@ -103,6 +104,26 @@ async def store_team_page(
     )
 
 
+@router.get(
+    "/team/roles", response_class=HTMLResponse, include_in_schema=False
+)
+async def store_roles_page(
+    request: Request,
+    store_code: str = Depends(get_resolved_store_code),
+    current_user: User = Depends(require_store_page_permission("team.view")),
+    db: Session = Depends(get_db),
+):
+    """
+    Render role editor page.
+    Store owners can create, edit, and delete custom roles
+    with a permission matrix UI.
+    """
+    return templates.TemplateResponse(
+        "tenancy/store/roles.html",
+        get_store_context(request, db, current_user, store_code),
+    )
+
+
 @router.get(
     "/profile", response_class=HTMLResponse, include_in_schema=False
 )