feat: Role-based access control

[Vitalcheffe]

Add RBAC with roles: Owner, Admin, Staff, Viewer with granular permissions.

Requirements:

• Role definitions and permissions matrix
• UI for managing team roles
• Enforce permissions on all API endpoints
• Audit log for role changes