Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/database/migrations/postgres/016_team_user_roles.sql

@@ -0,0 +1,17 @@
+-- ==========================================
+-- Armature — 016 Team User Roles (many-to-many)
+-- ==========================================
+
+CREATE TABLE IF NOT EXISTS team_user_roles (
+    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    team_id     UUID NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+    user_id     UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    role        VARCHAR(50) NOT NULL,
+    assigned_by UUID REFERENCES users(id) ON DELETE SET NULL,
+    assigned_at TIMESTAMPTZ DEFAULT NOW(),
+    UNIQUE(team_id, user_id, role)
+);
+
+CREATE INDEX IF NOT EXISTS idx_team_user_roles_team_user ON team_user_roles(team_id, user_id);
+CREATE INDEX IF NOT EXISTS idx_team_user_roles_team ON team_user_roles(team_id);
+CREATE INDEX IF NOT EXISTS idx_team_user_roles_user ON team_user_roles(user_id);

server/database/migrations/sqlite/016_team_user_roles.sql

@@ -0,0 +1,17 @@
+-- ==========================================
+-- Armature — 016 Team User Roles (many-to-many, SQLite)
+-- ==========================================
+
+CREATE TABLE IF NOT EXISTS team_user_roles (
+    id          TEXT PRIMARY KEY,
+    team_id     TEXT NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+    user_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    role        TEXT NOT NULL,
+    assigned_by TEXT REFERENCES users(id) ON DELETE SET NULL,
+    assigned_at TEXT DEFAULT (datetime('now')),
+    UNIQUE(team_id, user_id, role)
+);
+
+CREATE INDEX IF NOT EXISTS idx_team_user_roles_team_user ON team_user_roles(team_id, user_id);
+CREATE INDEX IF NOT EXISTS idx_team_user_roles_team ON team_user_roles(team_id);
+CREATE INDEX IF NOT EXISTS idx_team_user_roles_user ON team_user_roles(user_id);