Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/interfaces.go

@@ -188,6 +188,26 @@ type TeamStore interface {
 
 	// MergeSettings merges a JSON string into the team's settings column.
 	MergeSettings(ctx context.Context, teamID, settingsJSON string) error
+
+	// ── v0.9.3 — Team User Roles (many-to-many) ──
+
+	// AddUserRole assigns an additional role to a team member. Idempotent.
+	AddUserRole(ctx context.Context, teamID, userID, role, assignedBy string) error
+
+	// RemoveUserRole removes one additional role from a team member.
+	RemoveUserRole(ctx context.Context, teamID, userID, role string) error
+
+	// ListUserRoles returns the additional roles for a member (excludes primary).
+	ListUserRoles(ctx context.Context, teamID, userID string) ([]string, error)
+
+	// GetMemberRoles returns the full effective role set (primary + additional).
+	GetMemberRoles(ctx context.Context, teamID, userID string) ([]string, error)
+
+	// HasRole checks whether a user holds a specific role (primary or additional).
+	HasRole(ctx context.Context, teamID, userID, role string) (bool, error)
+
+	// RemoveAllUserRoles deletes all additional roles for a member (cleanup on removal).
+	RemoveAllUserRoles(ctx context.Context, teamID, userID string) error
 }
 
 // =========================================

server/store/postgres/team.go

@@ -308,3 +308,88 @@ func (s *TeamStore) MergeSettings(ctx context.Context, teamID, settingsJSON stri
 		settingsJSON, teamID)
 	return err
 }
+
+// ── v0.9.3 — Team User Roles (many-to-many) ──────────────────
+
+func (s *TeamStore) AddUserRole(ctx context.Context, teamID, userID, role, assignedBy string) error {
+	_, err := DB.ExecContext(ctx, `
+		INSERT INTO team_user_roles (team_id, user_id, role, assigned_by)
+		VALUES ($1, $2, $3, $4)
+		ON CONFLICT (team_id, user_id, role) DO NOTHING`,
+		teamID, userID, role, assignedBy)
+	return err
+}
+
+func (s *TeamStore) RemoveUserRole(ctx context.Context, teamID, userID, role string) error {
+	_, err := DB.ExecContext(ctx,
+		`DELETE FROM team_user_roles WHERE team_id = $1 AND user_id = $2 AND role = $3`,
+		teamID, userID, role)
+	return err
+}
+
+func (s *TeamStore) ListUserRoles(ctx context.Context, teamID, userID string) ([]string, error) {
+	rows, err := DB.QueryContext(ctx,
+		`SELECT role FROM team_user_roles WHERE team_id = $1 AND user_id = $2 ORDER BY role`,
+		teamID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var roles []string
+	for rows.Next() {
+		var r string
+		if err := rows.Scan(&r); err != nil {
+			return nil, err
+		}
+		roles = append(roles, r)
+	}
+	if roles == nil {
+		roles = []string{}
+	}
+	return roles, rows.Err()
+}
+
+func (s *TeamStore) GetMemberRoles(ctx context.Context, teamID, userID string) ([]string, error) {
+	rows, err := DB.QueryContext(ctx, `
+		SELECT role FROM team_members WHERE team_id = $1 AND user_id = $2
+		UNION
+		SELECT role FROM team_user_roles WHERE team_id = $1 AND user_id = $2
+		ORDER BY role`,
+		teamID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var roles []string
+	for rows.Next() {
+		var r string
+		if err := rows.Scan(&r); err != nil {
+			return nil, err
+		}
+		roles = append(roles, r)
+	}
+	if roles == nil {
+		roles = []string{}
+	}
+	return roles, rows.Err()
+}
+
+func (s *TeamStore) HasRole(ctx context.Context, teamID, userID, role string) (bool, error) {
+	var exists bool
+	err := DB.QueryRowContext(ctx, `
+		SELECT EXISTS(
+			SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2 AND role = $3
+			UNION ALL
+			SELECT 1 FROM team_user_roles WHERE team_id = $1 AND user_id = $2 AND role = $3
+		)`, teamID, userID, role).Scan(&exists)
+	return exists, err
+}
+
+func (s *TeamStore) RemoveAllUserRoles(ctx context.Context, teamID, userID string) error {
+	_, err := DB.ExecContext(ctx,
+		`DELETE FROM team_user_roles WHERE team_id = $1 AND user_id = $2`,
+		teamID, userID)
+	return err
+}

server/store/sqlite/team.go

@@ -314,3 +314,88 @@ func (s *TeamStore) MergeSettings(ctx context.Context, teamID, settingsJSON stri
 		settingsJSON, teamID)
 	return err
 }
+
+// ── v0.9.3 — Team User Roles (many-to-many) ──────────────────
+
+func (s *TeamStore) AddUserRole(ctx context.Context, teamID, userID, role, assignedBy string) error {
+	_, err := DB.ExecContext(ctx, `
+		INSERT INTO team_user_roles (id, team_id, user_id, role, assigned_by)
+		VALUES (?, ?, ?, ?, ?)
+		ON CONFLICT (team_id, user_id, role) DO NOTHING`,
+		store.NewID(), teamID, userID, role, assignedBy)
+	return err
+}
+
+func (s *TeamStore) RemoveUserRole(ctx context.Context, teamID, userID, role string) error {
+	_, err := DB.ExecContext(ctx,
+		`DELETE FROM team_user_roles WHERE team_id = ? AND user_id = ? AND role = ?`,
+		teamID, userID, role)
+	return err
+}
+
+func (s *TeamStore) ListUserRoles(ctx context.Context, teamID, userID string) ([]string, error) {
+	rows, err := DB.QueryContext(ctx,
+		`SELECT role FROM team_user_roles WHERE team_id = ? AND user_id = ? ORDER BY role`,
+		teamID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var roles []string
+	for rows.Next() {
+		var r string
+		if err := rows.Scan(&r); err != nil {
+			return nil, err
+		}
+		roles = append(roles, r)
+	}
+	if roles == nil {
+		roles = []string{}
+	}
+	return roles, rows.Err()
+}
+
+func (s *TeamStore) GetMemberRoles(ctx context.Context, teamID, userID string) ([]string, error) {
+	rows, err := DB.QueryContext(ctx, `
+		SELECT role FROM team_members WHERE team_id = ? AND user_id = ?
+		UNION
+		SELECT role FROM team_user_roles WHERE team_id = ? AND user_id = ?
+		ORDER BY role`,
+		teamID, userID, teamID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var roles []string
+	for rows.Next() {
+		var r string
+		if err := rows.Scan(&r); err != nil {
+			return nil, err
+		}
+		roles = append(roles, r)
+	}
+	if roles == nil {
+		roles = []string{}
+	}
+	return roles, rows.Err()
+}
+
+func (s *TeamStore) HasRole(ctx context.Context, teamID, userID, role string) (bool, error) {
+	var count int
+	err := DB.QueryRowContext(ctx, `
+		SELECT COUNT(*) FROM (
+			SELECT 1 FROM team_members WHERE team_id = ? AND user_id = ? AND role = ?
+			UNION ALL
+			SELECT 1 FROM team_user_roles WHERE team_id = ? AND user_id = ? AND role = ?
+		)`, teamID, userID, role, teamID, userID, role).Scan(&count)
+	return count > 0, err
+}
+
+func (s *TeamStore) RemoveAllUserRoles(ctx context.Context, teamID, userID string) error {
+	_, err := DB.ExecContext(ctx,
+		`DELETE FROM team_user_roles WHERE team_id = ? AND user_id = ?`,
+		teamID, userID)
+	return err
+}