feat: add per-action multi-issuer permission matrix (#544)

[sir-emmy1]

• Add Role enum (Compliance, Treasury, Operations) with bitmask support
• Add RoleGrant struct for per-offering role assignments
• Implement grant_role, revoke_role, and assert_role helpers
• Wire role checks into blacklist_add (Compliance), deposit_revenue (Treasury), and report_revenue (Treasury) entrypoints
• Role gate is opt-in: skipped when no role grants exist for backwards compat
• Add RoleNotGranted error variant (wire value 91)
• Emit role_granted and role_revoked events for audit trail
• Add comprehensive tests for grant, revoke, enforcement, isolation, and events
• Update AUTH_MATRIX.md with role matrix documentation
• Also includes transfer-restriction override (Add transfer-restriction override attestation allowing issuer to whitelist specific transfers #589) as shared infrastructure

[drips-wave]

Hey @sir-emmy1! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#544	Add multi-issuer per-action permission matrix restricting who can call which admin function	Link to this issue
#589	Add transfer-restriction override attestation allowing issuer to whitelist specific transfers	Link to this issue

ℹ️ Learn more about linking PRs to issues