Integrate Roles in data.source.coop

Description

Implement the Role system in the data proxy (data.source.coop) as described in ADR-004.

Roles belong to an account (Individual or Organization) and define:

• Who can assume the Role — identity constraints (IdP bindings with claim constraints)
• What the Role's credentials can access — permission statements (action + resource patterns)

Key Requirements

• Role schema: name, display_name, max_session_duration, identity_constraints[], permissions[]
• Role URN format: sc::{account_id}::role/{role_name}
• Built-in _default Role per account (unlimited ceiling, constrained to auth.source.coop IdP, cannot be deleted)
• Role CRUD API: POST/GET/PUT/DELETE /api/accounts/{account_id}/roles/{role_name}
• Identity constraint evaluation: claim constraints with equals and starts_with operators, AND within a binding, OR across bindings
• Permission statements: read/write actions with URN resource patterns supporting prefix scoping
• Role acts as a ceiling on account permissions — intersection at request time (ADR-005)
• Validation rules: name format, max session duration bounds, limits on bindings/constraints/statements

References

• ADR-004: Inbound Authentication — Role schema, identity constraints, permission statements
• ADR-005: Authorization Model — Role ceiling with dynamic account permission resolution

Start by reading ADR-004 and ADR-005, then inspect the existing data proxy architecture and account API entry points. Implement the role schema, CRUD endpoints, identity and permission evaluation, validation, and account-permission ceiling described in the issue. Done means the listed endpoints and authorization rules are integrated for Individual and Organization accounts, including the protected built-in _default role.