Role-based access control — admin, editor, standard user

[MA1002643]

Context

Brief §5.6.3 requires RBAC separating admin, editor and standard users; brief §10 requires least-privilege authorisation. Editorial curation (M7) has been running on interim role checks — this issue formalises the model before the full admin CMS opens more powerful surfaces.

Scope

• Role model: user (default), editor (catalogue curation, editorial collections, lyrics authoring), admin (everything + user management, moderation queue, licences, config); permission matrix documented in docs/security/RBAC.md and encoded as typed permission constants — checks reference permissions, never role names.
• Enforcement: tRPC middleware guard per procedure (deny-by-default for any procedure without an explicit permission annotation — CI check enforces annotation presence), plus route-level guards on admin UI surfaces; WS topics and REST endpoints covered equally.
• Administration: role assignment UI/API (admin-only, step-up MFA, audited), no self-demotion of the last admin, invitation flow for editors.
• Audit: every privileged action writes audit_log (actor, permission, target, before/after summary — no PII bloat).

Acceptance criteria

• Permission-matrix test suite: each role × each protected procedure asserts allow/deny per the documented matrix (generated from the matrix file so docs and code cannot drift).
• Unannotated procedure fails CI (deny-by-default proof).
• Privilege escalation attempts (editor→admin endpoints, IDOR on role assignment) rejected and audited (tests).
• Existing M7 editorial checks migrated onto the permission constants.

Technical notes

Keep it roles→permissions only — no per-object ACLs yet; playlist collaborator rights remain the domain model's concern, not RBAC's.

Dependencies

Depends on #19. Blocks #58, #61.