RBAC -- Roles & users

Define named roles, grant permission keys, assign users by email. Fresh installs seed admin + viewer; while the assignments table is empty every authenticated user gets every permission (so the first operator can edit this matrix).