authorization

In a FastAPI RBAC refactor, route-level checks scaled better when role hierarchy was centralized (`user < tenant_admin < platform_admin`) and minimum-role checks were generated from one dependency fac...