feat(server): add project RBAC and guarded workflows

tests/auth/test_rbac_migration.py

@@ -0,0 +1,14 @@
+from pathlib import Path
+
+
+def test_rbac_migration_normalizes_legacy_roles():
+    sql = Path("resources/sql/006_metadata_rbac_roles.sql").read_text(
+        encoding="utf-8"
+    )
+
+    assert "role IN ('admin', 'user')" in sql
+    assert "project_role IN ('member', 'viewer')" in sql
+    assert "'modeler'," in sql
+    assert "'dispatcher'" in sql
+    assert "THEN 'member'" in sql
+    assert "ELSE 'viewer'" in sql