feat(roles): add admin store roles page, permission i18n, and menu integration

- Add admin store roles page with merchant→store cascading for superadmin
  and store-only selection for platform admin
- Add permission catalog API with translated labels/descriptions (en/fr/de/lb)
- Add permission translations to all 15 module locale files (60 files total)
- Add info icon tooltips for permission descriptions in role editor
- Add store roles menu item and admin menu item in module definition
- Fix store-selector.js URL construction bug when apiEndpoint has query params
- Add admin store roles API (CRUD + platform scoping)
- Add integration tests for admin store roles and permission catalog

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/architecture/access-control-stack.md

@@ -203,7 +203,19 @@ The system provides 5 preset roles with predefined permission sets:
 | `viewer` | Read-only access | ~6 |
 | `marketing` | Marketing and customer data | ~7 |
 
-Preset roles are created automatically on first access. Store owners can also create custom roles with any combination of the ~75 available permissions.
+Preset roles are created automatically on first access. Store owners can also create custom roles with any combination of the available permissions via the role editor UI at `/store/{store_code}/team/roles`.
+
+### Custom Role Management
+
+Store owners can create, edit, and delete custom roles via:
+- **Store UI:** `/store/{store_code}/team/roles` (Alpine.js permission matrix)
+- **Store API:** `POST/PUT/DELETE /api/v1/store/team/roles`
+- **Admin UI:** `/admin/store-roles` (with Tom Select store picker)
+- **Admin API:** `GET/POST/PUT/DELETE /api/v1/admin/store-roles?store_id=X`
+
+The **Permission Catalog API** (`GET /api/v1/store/team/permissions/catalog`) returns all permissions grouped by category with labels and descriptions for the UI.
+
+Admin access is scoped: **super admins** can manage any store, while **platform admins** can only manage stores within their assigned platforms (validated via `StorePlatform` table).
 
 ### Enforcement Points
 
@@ -255,6 +267,7 @@ A user can have **different roles in different stores**. For example, a user mig
 ## Related Documentation
 
 - [Authentication & RBAC](auth-rbac.md) — JWT auth, user roles, enforcement methods
+- [Store RBAC](../backend/store-rbac.md) — Custom role CRUD, permission catalog API, admin role management
 - [Menu Management](menu-management.md) — Menu discovery, visibility config, AdminMenuConfig
 - [Module System](module-system.md) — Module architecture, auto-discovery, classification
 - [Feature Gating](../implementation/feature-gating-system.md) — Tier-based feature limits