Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/models/models.go

@@ -80,6 +80,16 @@ type TeamMember struct {
 	Username    string `json:"username,omitempty"`
 }
 
+// TeamUserRole is a many-to-many join: one user can hold multiple roles in a team.
+type TeamUserRole struct {
+	ID         string `json:"id" db:"id"`
+	TeamID     string `json:"team_id" db:"team_id"`
+	UserID     string `json:"user_id" db:"user_id"`
+	Role       string `json:"role" db:"role"`
+	AssignedBy string `json:"assigned_by,omitempty" db:"assigned_by"`
+	AssignedAt string `json:"assigned_at" db:"assigned_at"`
+}
+
 // PLATFORM POLICIES
 
 var PolicyDefaults = map[string]string{