Add multi-role permission system with a Role Management admin page

Users can now hold multiple roles, each with its own editable set of
create/edit/delete-style permissions across assets, shots, tasks, task
assignment, review approve/retake, submissions, uploads, and notes
(including internal vs. client note visibility). The 4 existing roles
(coordinator/director/artist/developer) are migrated into the new system
as system roles, seeded to reproduce today's actual behavior exactly;
admins can create custom roles (e.g. "Reviewer", "Outsourcing") via the
new Role Management page and assign multiple roles to a user via a new
"Manage Roles" action on the Team page.

Backend:
- New Role/Permission models and role_permissions/user_roles tables,
  plus a one-off, idempotent seed/backfill migration script.
- New require_permission()/user_has_permission() dependency, wired into
  the actual mutation endpoints across shots/assets/tasks/reviews,
  always preserving existing ownership- and self-service-based access
  (e.g. artists editing their own task status, own notes, own uploads,
  own submissions) as an unconditional fallback alongside the new
  permission checks - nothing that worked before now requires a role.
- New endpoints: PUT/DELETE on task submissions (wires up soft-deletion
  columns that existed on the model but were never exposed), plus full
  role CRUD and per-user role assignment.
- Along the way: fixed newly-created users not being linked to their
  matching system role (silently leaving them with zero permissions),
  and unified an inconsistency between the single vs. bulk task status
  endpoints that allowed different roles to bulk-update status.

Frontend:
- Role Management page with a grouped, human-readable permission editor
  (icons, plain-language action labels, per-resource select-all, live
  selected count) replacing an earlier dense matrix prototype.
- hasPermission() added to the existing usePermission() composable
  without touching its current isAdmin/isCoordinatorOrAdmin consumers.
- Note composer gets an Internal/Client toggle; submissions gain inline
  edit/delete actions gated the same ownership-or-permission way as notes.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/routers/shots.py

@@ -12,7 +12,7 @@ from schemas.shot import (
     ShotCreate, ShotUpdate, ShotResponse, ShotListResponse,
     BulkShotCreate, BulkShotResponse, TaskStatusInfo
 )
-from utils.auth import get_current_user_from_token
+from utils.auth import get_current_user_from_token, require_permission
 from services.shot_soft_deletion import ShotSoftDeletionService
 
 router = APIRouter()
@@ -27,22 +27,6 @@ def get_current_user_with_db(
     return _get_user_from_db(db, token_data["user_id"])
 
 
-def require_coordinator_or_admin(
-    token_data: dict = Depends(get_current_user_from_token),
-    db: Session = Depends(get_db)
-):
-    """Require coordinator or admin role."""
-    from utils.auth import _get_user_from_db
-    current_user = _get_user_from_db(db, token_data["user_id"])
-    
-    if current_user.role != UserRole.COORDINATOR and not current_user.is_admin:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Insufficient permissions"
-        )
-    return current_user
-
-
 def check_episode_access(episode_id: int, current_user: User, db: Session):
     """Check if user has access to the episode and its project."""
     # Debug logging
@@ -381,7 +365,7 @@ async def create_shot(
     episode_id: int,
     create_default_tasks: bool = True,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_coordinator_or_admin)
+    current_user: User = Depends(require_permission('shot', 'create'))
 ):
     """Create a new shot in an episode"""
     # Check episode access
@@ -452,7 +436,7 @@ async def create_shots_bulk(
     bulk_shot: BulkShotCreate,
     episode_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_coordinator_or_admin)
+    current_user: User = Depends(require_permission('shot', 'create'))
 ):
     """Create multiple shots with naming pattern and default tasks"""
     # Check episode access
@@ -674,7 +658,7 @@ async def create_shot_task(
     shot_id: int,
     task_type: str,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_coordinator_or_admin)
+    current_user: User = Depends(require_permission('task', 'create'))
 ):
     """Create a new task for a shot"""
     # Exclude soft deleted shots
@@ -737,7 +721,7 @@ async def update_shot(
     shot_id: int,
     shot_update: ShotUpdate,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_coordinator_or_admin)
+    current_user: User = Depends(require_permission('shot', 'edit'))
 ):
     """Update a shot"""
     from sqlalchemy.orm import selectinload
@@ -818,7 +802,7 @@ async def update_shot(
 async def get_shot_deletion_info(
     shot_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_coordinator_or_admin)
+    current_user: User = Depends(require_permission('shot', 'delete'))
 ):
     """Get information about what will be deleted when deleting a shot"""
     # Exclude soft deleted shots
@@ -868,7 +852,7 @@ async def get_shot_deletion_info(
 async def delete_shot(
     shot_id: int,
     db: Session = Depends(get_db),
-    current_user: User = Depends(require_coordinator_or_admin)
+    current_user: User = Depends(require_permission('shot', 'delete'))
 ):
     """Soft delete a shot and all its associated data"""
     # Exclude soft deleted shots