RBAC: role enum + require_role

[richardmhope]

Proposal

Replace the User.is_admin bool with a role enum (admin / analyst / auditor) and generalize require_admin → require_role(...).

• Auditor = read-only; analyst = triage but not user/destination admin; admin = full.

Cross-cutting

• Migration per the _migrate_* pattern (backfill existing admins).

Acceptance

• Auditor is blocked (403) from mutating routes; analyst can triage but not manage users/destinations.

---

From the PLAN.md roadmap to a SOC-consumable Marvin.