Role-Based Access Control

PROJECT CONTEXT:
I am adding roles (e.g. admin, member, viewer) so different users have different capabilities in my app.

GOAL:
Implement roles stored per user, enforced on every protected endpoint, and reflected in the UI.

REQUIREMENTS:
- Role field on the user model with defined role set
- Permission matrix: which role can do which action
- Backend enforcement (403) on every protected endpoint
- UI adaptation: hidden/disabled controls per role
- An admin surface to change user roles

CONSTRAINTS:
- Hiding buttons is not enforcement - the backend must reject
- Never trust a role claim from the client
- Protect against self-demotion of the last admin

DEFINITION OF DONE:
- Each role sees the correct UI
- Forbidden API calls return 403 regardless of UI
- Role changes take effect without re-registration
- The last admin cannot remove their own admin role

COMMON FAILURES TO AVOID:
- Role checks only in the frontend
- Role read from localStorage where users can edit it
- Admin endpoints open to any authenticated user
- Role changes requiring logout/login to apply