Roles administration - promote permission bits to managed roles

[andywithcamera]

State today (verified in code):
- Permission primitive exists (internal/authz/Permissions.go): view/write/admin bits, RequirePermission, UserHasPermission(userID, perm, appID) - group-scoped.
- AuditMiddleware exists.
- But no managed 'roles' concept and no admin UI to define/assign roles.

The ask: a first-class roles system on top of the existing permission bits, with an admin surface to define roles and assign them to users/groups.

Drivers:

• The task-engine needs system roles (e.g. the task_qa bypass role from the task-chat spec) alongside group membership.
• Roles admin is the guardrail the whole agency model hangs on (Task engine: agent identities as users (authN differs, authZ identical) #68 agents-as-users, Task chat: two channels per task (team chat / customer notifications), scope as v2 #72 task chat, Service desk: authenticated conversational front-of-house agent (order catalog + track tasks) #85 desk).

Scope:

• role = named set of permissions; assign to users and groups.
• Built-in system roles (viewer/editor/admin + reserved task_qa-style bypass).
• Admin UI to manage roles.
• Keep live alongside existing per-app permission bits (AuditMiddleware covers the trail).

Category: c:infra. Depends: existing authz/.