feat(authz): install Bouncer and establish baseline RBAC

[ibourgeois]

Goal

Add role-based authorization with Bouncer for the first protected areas of the app.

Scope

• Install and configure Bouncer
• Create baseline admin and user roles
• Give admin full access
• Establish centralized admin-area authorization rules

Out of Scope

• Fine-grained permission matrix for every future app
• Team or organization modeling

Acceptance Criteria

• Bouncer is installed and roles are seeded or otherwise provisioned cleanly
• Admin-only areas can be protected consistently
• Baseline role checks are covered by tests

Dependencies

• Depends on feat(auth): install Fortify and wire backend authentication flows #7

Test Plan

• Add authorization tests for admin and non-admin access
• Verify role assignment behavior for baseline roles