[Epic]: RBAC beyond admin and user

## Summary
Extend RBAC beyond today's admin/user split to at minimum org-admin, team-admin, auditor (read-only) and end-user roles, with enforcement tests shipped alongside every role definition.

## Intent / Source of truth
Enterprises expect at minimum org-admin, team-admin, auditor/read-only and end-user roles; an auditor role that can read evidence without mutating anything is specifically required for compliance workflows. Note the live precedent: lightbridge-authz#177 shows a governance ceiling silently unenforced because validation code was never called — new roles must ship with enforcement tests, not just definitions.

## Scope
- [ ] Role model covering org-admin, team-admin, auditor (read-only), end-user
- [ ] Auditor role: read access to policy/audit/config surfaces, zero mutation rights anywhere
- [ ] Enforcement test suite proving every role boundary is actually checked at the API layer (not just declared)
- [ ] Regression test specifically closing the #177 pattern (a defined-but-uncalled validation path)

## Out of scope
- Fully custom/attribute-based access control (ABAC) — role-based is sufficient for this epic

## Verification
Negative-path tests proving an auditor cannot mutate any resource; a review confirming every role-check in the codebase is actually invoked on the request path (not merely defined), directly addressing the #177 failure mode.

## Risk assessment
The #177 precedent is exactly this failure mode: a role/permission boundary that exists in code but is never called on the live request path, so the "ceiling" is unenforced in production while looking correct in review. Every role added here must have a test that fails if the enforcement call is removed.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

Start by locating the existing role model and every API-layer role-check or validation path, including policy, audit, and config surfaces; compare the live request path with the defined checks and the lightbridge-authz#177 precedent. Done means the four roles are enforced, auditor mutation attempts are rejected, and tests fail if any enforcement call is removed.

Escrita pelo modelo de indexação a partir do texto da issue.