Port RBAC support + `rbac-dot` from the Go fork

[beengud]

Port RBAC support + rbac-dot from the Go fork

Source: beengud/observe RBAC support (commit d17dec0). Files: cmd_rbac_dot.go, ot_rbacgroup.go, ot_rbacgroupmember.go, ot_rbacstatement.go, ot_user.go.
New CLI status: Absent — no user/group/permission management.

Old command surface

observe rbac-dot --user <id>     # plot membership/relationship graph for a user
observe rbac-dot --all           # plot all users/groups/statements
# plus generic object access via ot_*.go: list/get rbac groups, group members, statements, users

Output of rbac-dot is a GraphViz DOT file on stdout (pipe through dot to render PNG/SVG).

Acceptance

• RBAC object read access (groups, group members, statements, users) + rbac-dot graph export ported. Decide scope: read/visualize first; mutation later if needed.