LCFS - Basic BCeID restrictions

**Describe the task**
Implement role restriction logic for Basic BCeID users. When support for Basic BCeID authentication is introduced, users authenticated with a Basic BCeID account must be prevented from being assigned or holding restricted roles, including the **Managing users** role.

**Purpose**
To ensure role permissions align with authentication assurance levels and prevent Basic BCeID users from accessing administrative capabilities.

**Acceptance Criteria**
- [ ] The system can identify whether a logged-in user is authenticated using a Basic BCeID account.
- [ ] Basic BCeID users cannot be assigned restricted roles, including the **Managing users** role.
- [ ] Existing users logging in with Basic BCeID who currently hold restricted roles are prevented from accessing those permissions.
- [ ] Role assignment UI prevents selection of restricted roles for Basic BCeID users.
- [ ] Backend authorization enforces role restrictions regardless of UI controls.
- [ ] Clear validation messaging is displayed if a restricted role assignment is attempted.
- [ ] No impact occurs to Business BCeID or IDIR role assignment workflows.

**Additional context**
- This task prepares the system for future Basic BCeID support and may initially be feature-flagged.
- Restricted roles list should be configurable to allow expansion beyond the Managing users role in future.
- Ensure both role assignment and permission evaluation layers enforce restrictions.

Start by locating the authentication model, role-assignment UI, and backend permission-evaluation paths; the payload does not name specific files or tests. Trace how Basic BCeID users are identified and how restricted roles are assigned and checked. Done means restricted roles are blocked in both UI and backend, existing affected users cannot use those permissions, validation is clear, and Business BCeID and IDIR workflows remain unchanged.

Written by the indexing model from the issue text.