[Epic] RBAC/permissions model enhancements

Tracking epic for RBAC/permission-model feature requests: database-level role permissions, user impersonation, and preventing self-role-removal. Distinct from the access-control enforcement-gap bugs tracked separately.

---
_Filed by Claude (Opus 4.8), issue-backlog triage & grouping pass._

This is a tracking epic listing database-level role permissions, user impersonation, and preventing self-role-removal; it names no files, tests, or code entry points. Read the individual feature requests and related access-control enforcement-gap bugs before choosing a scoped task; this issue alone does not define a completion criterion.

Written by the indexing model from the issue text.