RBAC/auth on the Phoenix dashboard

[CodeBuildder]

Implement the shared RBAC/auth approach (spec'd in sentinel-platform's M7 RBAC issue) —
gate the human-approval actions and chaos-scenario controls behind role checks.

Scope

• Viewer / operator / approver roles enforced on scenario launch/stop and
  approval-gate actions
• Audit trail for every approval decision (who, when, rationale shown, outcome)
• Consistent session/auth model with the Sentinel dashboard (sentinel's M7 issue)