Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ROADMAP.md

@@ -98,12 +98,12 @@ Consolidated duplicate Go↔Starlark converters into `sandbox/convert.go`
 Standardized on wrapped snapshot format. ~350 lines of duplication removed.
 Design doc: `docs/DESIGN-workflow-redesign.md`.
 
-**v0.9.3 — Team User Roles**
+**v0.9.3 — Team User Roles** *(completed)*
 
-Promote the buried role system to a kernel primitive. New
-`team_user_roles` table (many-to-many). Manifest `requires_roles` field.
-Team admin UI for role assignment. Kernel middleware `RequireRole()`.
-Starlark SDK: `teams.get_member_roles()`, `teams.has_role()`.
+Many-to-many `team_user_roles` table. `RequireRole()` middleware.
+Manifest `requires_roles` field (advisory). Starlark `teams` module
+with `get_member_roles()` and `has_role()`. Team-admin UI with role
+badge chips and assignment dropdown. 10 new tests.
 
 **v0.9.4 — Package Adoption + Roles**