Roles & Entra Group RBAC

Three core roles are seeded automatically. Map Entra group IDs to roles here — users are assigned/removed on every SSO sign-in. Manual role assignments persist regardless of group membership.