feat(api): standardize REST contracts and auth

AUTHENTICATION_AND_USER_MANAGEMENT.md

@@ -13,6 +13,25 @@ TJWater metadata stores only business snapshots and authorization data:
 The backend does not accept passwords, does not issue local JWTs, and does not
 trust frontend-supplied user IDs.
 
+## Fixed Project RBAC
+
+Project roles are stored directly in
+`user_project_membership.project_role`; there is no separate role table or
+user-defined permission editor in this delivery.
+
+| Role | Main access |
+| --- | --- |
+| `modeler` | Model upload/import, simulation, burst, risk, and optimization analysis |
+| `dispatcher` | SCADA cleaning, simulation and burst analysis |
+| `auditor` | Project read access and project-scoped audit logs |
+| `viewer` | WebGIS and read-only risk results |
+
+Legacy `owner`, `admin`, and `member` values remain supported for existing
+records. The backend is the authorization boundary; the frontend uses
+`GET /api/v1/access/context` only to hide unavailable menus and guard routes.
+System admins receive environment, membership, and global-audit permissions,
+but still need a project membership for project business APIs.
+
 ## Login Snapshot Refresh
 
 Every authenticated metadata-user resolution validates the Keycloak access token
@@ -77,14 +96,22 @@ Apply metadata patches in order:
 
 1. `resources/sql/004_metadata_auth_management.sql`
 2. `resources/sql/005_metadata_project_configuration.sql`
+3. `resources/sql/006_metadata_rbac_roles.sql`
 
 `004` creates Keycloak-backed metadata users and project memberships. `005`
 creates project and project database routing tables with uniqueness, role/type,
-and pool-size constraints.
+and pool-size constraints. `006` extends existing membership constraints with
+the fixed delivery roles.
 
 ## Frontend System Management
 
-`/system-admin` is shown only after `GET /api/v1/admin/me` confirms metadata
-admin access. The page lets admins maintain metadata users, project members,
-projects, project database routing for `biz_data` and `iot_data`, connection
-health checks. This replaces direct SQL editing for normal project onboarding.
+`/system-admin` is shown only when `GET /api/v1/access/context` returns
+`environment.manage`. The page lets admins maintain metadata users, project
+members, projects, project database routing for `biz_data` and `iot_data`, and
+connection health checks. This replaces direct SQL editing for normal project
+onboarding.
+
+Hydraulic model authoring is outside the Web application. Models are prepared
+in the desktop modeling client and uploaded/imported by an authorized modeler;
+the system administrator configures the project environment and database
+routing.