Add Role-Based User Permissions

Add a role-based permission system to this project.

Requirements:
- Create a dedicated roles table with a user reference and a role value of admin, editor or member. Do NOT store the role on the profiles table.
- Create a security-definer function that returns whether a given user has a given role.
- Use that function inside row level security policies so admins can manage all rows and members can only manage their own.
- Add an admin-only area that re-checks the role server-side, not just in the interface.
- Add a way for an existing admin to grant and revoke roles.

Acceptance criteria:
- A member account cannot load admin pages or admin data, even by typing the URL.
- A member cannot change their own role.
- Privileged server actions fail cleanly for non-admins.

Do not change anything outside the permission system.