Feat: Introduce user roles, implement role-based access control middleware

[GideonBature]

Summary

This PR introduces a Role-Based Access Control (RBAC) system to the backend. It adds a role field to users, updates the JWT claims to carry permissions, and implements middleware guards to protect specific routes based on user roles (Admin, Merchant, User).

Key Changes

1. Database & Models

• Migration: Added backend/migrations/20260123000000_add_user_roles.sql to add a role column to the users table (defaults to 'user').
• Models: Updated the User struct to include the role field.
• Enums: Created a new Role enum in src/role.rs with variants: User, Merchant, Admin. Implemented has_permission logic to handle role hierarchy (e.g., Admin has access to Merchant/User scopes).

2. Authentication & JWT

• Updated generate_jwt and validate_jwt in src/auth.rs to include the user's role in the token claims.
• Updated IdentityService to handle role assignment during user creation and retrieval.

3. Middleware & Security

• New Middleware: Created src/middleware/role_guard.rs implementing:
  • require_role: strict role checking.
  • require_any_role: checks against a list of allowed roles.
  • admin_only & merchant_or_admin: helper guards.
• Route Protection: Updated src/app.rs to apply role_guard::require_role(Role::Admin) to administration routes (dashboard stats, system health, etc.).

4. Testing

• Added comprehensive unit tests in backend/tests/auth_guard_test.rs covering:
  • Role hierarchy and permission logic.
  • JWT generation/validation with roles.
  • Middleware guard logic.

Database Migrations

• Includes a migration file (20260123000000_add_user_roles.sql)
• Note: Existing users will be backfilled with the User role by default.

Testing Plan

• Run cargo test to execute the new auth guard and role tests.
• Manual Verification:
  1. Register a new user (default role).
  2. Attempt to access /admin/* routes (should return 403 Forbidden).
  3. Manually update the user role to admin in the database.
  4. Regenerate token/login and verify access to /admin/* routes.

Closes #8

[ONEONUORA]

Nice implementation @GideonBature

[anonfedora]

LGTM🚀... Merging nwo