Users and Roles

Caution

Stub — cover the three system roles (admin / technician / read-only), custom roles via the permission matrix, and client scoping (#71).