feat(server): add project RBAC and guarded workflows

app/domain/schemas/access.py

@@ -0,0 +1,13 @@
+from uuid import UUID
+
+from pydantic import BaseModel
+
+
+class AccessContextResponse(BaseModel):
+    user_id: UUID
+    username: str
+    system_role: str
+    is_system_admin: bool
+    project_id: UUID | None = None
+    project_role: str | None = None
+    permissions: list[str]

app/domain/schemas/admin_metadata.py

@@ -5,8 +5,8 @@ from uuid import UUID
 from pydantic import BaseModel, ConfigDict, Field, model_validator
 
 
-BusinessRole = Literal["admin", "user", "operator", "viewer"]
-ProjectRole = Literal["owner", "admin", "member", "viewer"]
+BusinessRole = Literal["admin", "user"]
+ProjectRole = Literal["member", "viewer"]
 ProjectStatus = Literal["active", "inactive", "archived"]
 ProjectDbRole = Literal["biz_data", "iot_data"]