Feat v0.9.3 team user roles

Promote team roles to a kernel primitive with many-to-many support.
Users can now hold multiple roles within a team simultaneously.

- Migration 016: team_user_roles table (both dialects)
- 6 new TeamStore methods (AddUserRole, RemoveUserRole, ListUserRoles,
  GetMemberRoles, HasRole, RemoveAllUserRoles)
- RequireRole() middleware with OR semantics and system admin bypass
- 3 new handler endpoints for member role CRUD
- Manifest requires_roles field (advisory for v0.9.3)
- Starlark teams module: get_member_roles(), has_role()
- Team-admin UI: role badge chips + assignment dropdown
- Fixed pre-existing SDK auto-unwrap bug in loadRoles
- 10 new tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/store/postgres/team.go

@@ -308,3 +308,88 @@ func (s *TeamStore) MergeSettings(ctx context.Context, teamID, settingsJSON stri
 		settingsJSON, teamID)
 	return err
 }
+
+// ── v0.9.3 — Team User Roles (many-to-many) ──────────────────
+
+func (s *TeamStore) AddUserRole(ctx context.Context, teamID, userID, role, assignedBy string) error {
+	_, err := DB.ExecContext(ctx, `
+		INSERT INTO team_user_roles (team_id, user_id, role, assigned_by)
+		VALUES ($1, $2, $3, $4)
+		ON CONFLICT (team_id, user_id, role) DO NOTHING`,
+		teamID, userID, role, assignedBy)
+	return err
+}
+
+func (s *TeamStore) RemoveUserRole(ctx context.Context, teamID, userID, role string) error {
+	_, err := DB.ExecContext(ctx,
+		`DELETE FROM team_user_roles WHERE team_id = $1 AND user_id = $2 AND role = $3`,
+		teamID, userID, role)
+	return err
+}
+
+func (s *TeamStore) ListUserRoles(ctx context.Context, teamID, userID string) ([]string, error) {
+	rows, err := DB.QueryContext(ctx,
+		`SELECT role FROM team_user_roles WHERE team_id = $1 AND user_id = $2 ORDER BY role`,
+		teamID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var roles []string
+	for rows.Next() {
+		var r string
+		if err := rows.Scan(&r); err != nil {
+			return nil, err
+		}
+		roles = append(roles, r)
+	}
+	if roles == nil {
+		roles = []string{}
+	}
+	return roles, rows.Err()
+}
+
+func (s *TeamStore) GetMemberRoles(ctx context.Context, teamID, userID string) ([]string, error) {
+	rows, err := DB.QueryContext(ctx, `
+		SELECT role FROM team_members WHERE team_id = $1 AND user_id = $2
+		UNION
+		SELECT role FROM team_user_roles WHERE team_id = $1 AND user_id = $2
+		ORDER BY role`,
+		teamID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var roles []string
+	for rows.Next() {
+		var r string
+		if err := rows.Scan(&r); err != nil {
+			return nil, err
+		}
+		roles = append(roles, r)
+	}
+	if roles == nil {
+		roles = []string{}
+	}
+	return roles, rows.Err()
+}
+
+func (s *TeamStore) HasRole(ctx context.Context, teamID, userID, role string) (bool, error) {
+	var exists bool
+	err := DB.QueryRowContext(ctx, `
+		SELECT EXISTS(
+			SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2 AND role = $3
+			UNION ALL
+			SELECT 1 FROM team_user_roles WHERE team_id = $1 AND user_id = $2 AND role = $3
+		)`, teamID, userID, role).Scan(&exists)
+	return exists, err
+}
+
+func (s *TeamStore) RemoveAllUserRoles(ctx context.Context, teamID, userID string) error {
+	_, err := DB.ExecContext(ctx,
+		`DELETE FROM team_user_roles WHERE team_id = $1 AND user_id = $2`,
+		teamID, userID)
+	return err
+}