RBAC: Manage host roles through the Studio management bridge

## Parent

- #806

## What to build

Extend the reusable scope-owned role model with a distinct host role plane. Authorized operators can administer Host Operator, Tenant Support Operator, and Security Auditor roles through the Studio management bridge while the browser continues to use its normal user session and never receives the Elsa host management key.

Host assignments authorize host-control operations only. They do not select a tenant, contribute tenant permissions, or expose tenant workflow content. Tenant mutations remain structurally incapable of granting host authority.

Covers PRD user stories 1-3, 6, 12-22, 47-50, 57-59, 73, 75-76, and 95-99.

## Acceptance criteria

- [ ] Host roles and assignments persist in a distinct host authorization scope using the shared flat, allow-only, revisioned role contract.
- [ ] Tenant role mutation cannot contain a host permission, and host role assignment cannot contribute to any tenant effective-permission set.
- [ ] Host role and assignment APIs provide the same concurrency, idempotency, immutability, deletion-conflict, validation, and audit behavior as tenant administration.
- [ ] Studio exposes host role administration only when the host capability is available and the user has the required host permission.
- [ ] Browser calls traverse the Studio management bridge, which validates the user session and host permission and keeps the host management credential server-side.
- [ ] A Host Operator can perform an allowed host-control action but cannot read a representative tenant workflow without a later tenant support context.
- [ ] Similar role names in the host and a tenant remain independent identities and cannot be assigned across scopes.
- [ ] Server, bridge, browser, and security tests prove host/tenant isolation, capability-plus-entitlement behavior, direct-route denial, audit output, and absence of management-key exposure.

## Blocked by

- #830

Start with the parent issue #806 and the blocking issue #830, then trace the server, Studio management bridge, browser, and security-test surfaces named in the acceptance criteria. Done means distinct host authorization scope, host/tenant isolation, capability and entitlement checks, server-side credential protection, audit behavior, and passing server, bridge, browser, and security tests.

Written by the indexing model from the issue text.