Add RBAC models and SQLAdmin views for issue #275

[sdrarunvarshan]

Summary

Implements #275 (RBAC Phase 3: SQLAdmin integration).

main did not yet have Role / RolePermission / UserRole, so this PR also adds the minimum Phase 1 models, permission tree, service, and API routes needed for the admin views to run.

Related: #237

What changed

• New backend/src/modules/role/ module:
  • Role, RolePermission, UserRole models
  • PermissionNames + PERMISSION_TREE (permissions as code constants)
  • service, schemas, require_permissions dependency, role API routes
• SQLAdmin views:
  • RoleAdmin
  • RolePermissionAdmin (dropdown from flattened permission tree)
  • UserRoleAdmin
• User admin detail shows assigned roles
• User.user_roles relationship
• Alembic migration for roles, role_permission, user_role
• Tests
• Admin docs: docs/user-guide/admin-panel/rbac-management.md

How to test

1. From backend/: uv run alembic upgrade head
2. Start the app and open /admin
3. Log in with ADMIN_USERNAME / ADMIN_PASSWORD
4. Under Users & Access: create a Role, assign a permission, assign the role to a user
5. Delete a role and confirm it is soft-deleted (is_deleted)
6. Unauthenticated /admin/role/list should redirect/deny