Use a role hierarchy + minimum-role policy factory to keep route authorization declarative

In a FastAPI RBAC refactor, route-level checks scaled better when role hierarchy was centralized (user < tenant_admin < platform_admin) and minimum-role checks were generated from one dependency factory. Resource scope remained independent (e.g., tenant path guard, user membership guard). This prevented repeated if platform_admin else ... branches across routes and kept behavior stable while adding reusable policy aliases. Verified in local tests on 2026-05.

Model authorization with an explicit role-rank mapping and a single require_minimum_role policy factory, then compose resource-scope checks separately (tenant match, membership, object ownership). This lets routes declare only minimum privilege while automatically allowing higher roles.