Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/sandbox/runner.go

@@ -454,6 +454,9 @@ func (r *Runner) buildModulesWithLibCtx(ctx context.Context, packageID string, m
 	// Always available — read-only check against kernel permission data
 	modules["permissions"] = BuildPermissionsModule(ctx, r.stores)
 
+	// Always available — read-only team role queries
+	modules["teams"] = BuildTeamsModule(ctx, r.stores)
+
 	// Allows any starlark package to load declared library dependencies.
 	if lc != nil {
 		modules["lib"] = BuildLibModule(ctx, r, packageID, rc, lc)

server/sandbox/teams_module.go

@@ -0,0 +1,62 @@
+// Package sandbox — teams_module.go
+//
+// Read-only module for querying team role membership from Starlark scripts.
+// No sandbox permission required — extensions can check roles without special grants.
+//
+// Starlark API:
+//   teams.get_member_roles(team_id, user_id)  → ["admin", "reviewer", ...]
+//   teams.has_role(team_id, user_id, role)     → True/False
+package sandbox
+
+import (
+	"context"
+
+	"go.starlark.net/starlark"
+	"go.starlark.net/starlarkstruct"
+
+	"armature/store"
+)
+
+// BuildTeamsModule creates the "teams" module.
+// Always available to all extensions (no permission gate).
+func BuildTeamsModule(ctx context.Context, stores store.Stores) *starlarkstruct.Module {
+	return MakeModule("teams", starlark.StringDict{
+
+		"get_member_roles": starlark.NewBuiltin("teams.get_member_roles", func(
+			thread *starlark.Thread, b *starlark.Builtin,
+			args starlark.Tuple, kwargs []starlark.Tuple,
+		) (starlark.Value, error) {
+			var teamID, userID string
+			if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 2, &teamID, &userID); err != nil {
+				return nil, err
+			}
+
+			roles, err := stores.Teams.GetMemberRoles(ctx, teamID, userID)
+			if err != nil {
+				return starlark.NewList(nil), nil
+			}
+
+			elems := make([]starlark.Value, len(roles))
+			for i, r := range roles {
+				elems[i] = starlark.String(r)
+			}
+			return starlark.NewList(elems), nil
+		}),
+
+		"has_role": starlark.NewBuiltin("teams.has_role", func(
+			thread *starlark.Thread, b *starlark.Builtin,
+			args starlark.Tuple, kwargs []starlark.Tuple,
+		) (starlark.Value, error) {
+			var teamID, userID, role string
+			if err := starlark.UnpackPositionalArgs(b.Name(), args, kwargs, 3, &teamID, &userID, &role); err != nil {
+				return nil, err
+			}
+
+			has, err := stores.Teams.HasRole(ctx, teamID, userID, role)
+			if err != nil || !has {
+				return starlark.False, nil
+			}
+			return starlark.True, nil
+		}),
+	})
+}