Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/interfaces.go

@@ -188,6 +188,26 @@ type TeamStore interface {
 
 	// MergeSettings merges a JSON string into the team's settings column.
 	MergeSettings(ctx context.Context, teamID, settingsJSON string) error
+
+	// ── v0.9.3 — Team User Roles (many-to-many) ──
+
+	// AddUserRole assigns an additional role to a team member. Idempotent.
+	AddUserRole(ctx context.Context, teamID, userID, role, assignedBy string) error
+
+	// RemoveUserRole removes one additional role from a team member.
+	RemoveUserRole(ctx context.Context, teamID, userID, role string) error
+
+	// ListUserRoles returns the additional roles for a member (excludes primary).
+	ListUserRoles(ctx context.Context, teamID, userID string) ([]string, error)
+
+	// GetMemberRoles returns the full effective role set (primary + additional).
+	GetMemberRoles(ctx context.Context, teamID, userID string) ([]string, error)
+
+	// HasRole checks whether a user holds a specific role (primary or additional).
+	HasRole(ctx context.Context, teamID, userID, role string) (bool, error)
+
+	// RemoveAllUserRoles deletes all additional roles for a member (cleanup on removal).
+	RemoveAllUserRoles(ctx context.Context, teamID, userID string) error
 }
 
 // =========================================