feat(auth): reusable roles #160

Problem

In the first authorization release, an account's access is a set of grants, each one permission on a scope (all applications or a list of applications). Teams repeat the same grant combinations on every account and every invitation: "can deploy and read logs", "can manage secrets", and so on. Without reusable bundles, changing what a team can do means editing every one of its accounts individually.

Proposed solution

• A role is a named bundle of permissions. Assigning one picks the scope at assignment time: "deployer on blog" and "deployer on shop" use the same role.
• An account's access is its direct grants plus its role assignments. Roles are live references: editing a role changes access for every holder, and for their tokens (tokens remain token ∩ owner, evaluated per request).
• Tokens never reference roles. A role can pre-fill a token's grants at creation, but the token stores an explicit grant list, so editing a role never widens existing tokens.
• On the first start with roles, piqueld creates one admin role containing the admin permission (every ability, including future ones). After that it is an ordinary role. No other roles exist by default, and none are assigned automatically.
• Creating, editing, deleting, and assigning roles requires accounts:manage and follows the escalation rule: a role may only contain permissions the editor holds, and only within the editor's scope.
• Deleting a role that is still assigned is rejected; the dashboard shows who holds it.
• The "at least one global admin with a passkey" invariant holds across role edits and unassignments, not just account changes.
• Role changes are audit events (role_created, role_updated with the permission diff, role_deleted, role_assigned, role_unassigned). Adding admin, accounts:manage, or system:operate to a role triggers the security notification category.
• CLI: piquelctl role list|show|create|edit|delete|assign|unassign. Dashboard: a Roles page with a permission picker grouped by area. Invitations can assign roles.

Written with Claude Opus 5.5 in Claude Code.