Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/middleware/team.go

@@ -54,6 +54,51 @@ func RequireTeamAdmin(teams store.TeamStore, allStores ...store.Stores) gin.Hand
 	}
 }
 
+// RequireRole returns middleware that restricts access to users holding at least
+// one of the specified roles in the team identified by :teamId.
+// Checks both the primary role (team_members.role) and additional roles
+// (team_user_roles). System admins are always allowed through.
+func RequireRole(teams store.TeamStore, roles []string, allStores ...store.Stores) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if len(allStores) > 0 && isSystemAdmin(c, allStores[0]) {
+			c.Next()
+			return
+		}
+
+		userID := c.GetString("user_id")
+		teamID := c.Param("teamId")
+		if teamID == "" {
+			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{
+				"error": "team ID required",
+			})
+			return
+		}
+
+		memberRoles, err := teams.GetMemberRoles(c.Request.Context(), teamID, userID)
+		if err != nil || len(memberRoles) == 0 {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"error": "required role not held",
+			})
+			return
+		}
+
+		roleSet := make(map[string]bool, len(memberRoles))
+		for _, r := range memberRoles {
+			roleSet[r] = true
+		}
+		for _, required := range roles {
+			if roleSet[required] {
+				c.Next()
+				return
+			}
+		}
+
+		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+			"error": "required role not held",
+		})
+	}
+}
+
 // RequireTeamMember returns middleware that restricts access to users who
 // belong to the team identified by :teamId (any role).
 // System admins are always allowed through.