feat(db/api): role-assignments surface — query layer, REST resource, MCP tools, hasAtLeastRole (ADR-052 D7 remainder)

[thewrz]

Why

PR #462 (#381) shipped the actor-identity substrate: users plus the role_assignments table — but the role table is schema-only. The query/REST/MCP layer was deliberately split out because src/db/index.ts sits against its 400-line ESLint cap; ADR-052 D7 records the measured rationale. Without this surface, roles cannot be granted or consulted, so the #382 consistency-review divert logic and the phased enforcement points (#381 round 4) have nothing to key on.

What

• src/db/queries/role-assignments.ts: grant/revoke/list by scope (project_id | library_id XOR, per migration 045), barrel-exported (may require the planned src/db/index.ts split to stay under the line cap — do that here, not around it).
• REST /role-assignments resource (create/delete/list, scope-filtered), Zod-validated, documented in openapi.yaml in the same PR.
• MCP tools mirroring the REST surface, contract-mapped + tier-gated (write for grant/revoke, read for list) per ADR-044/045.
• src/lib/roles.ts: hasAtLeastRole(user, scope, role) resolution helper — the enforcement point that the edit gate and feat: consistency-review mode — enforced role-scoped spec lockout with per-user suggestion branches (git-like, ADR required) #382 will consult (viewer < editor < spec-editor < admin).
• ADR-052 D7: flip from schema-implemented to Implemented.

Prior art

• Migration 045 (users + role_assignments, XOR CHECK scope FKs) — merged with PR feat(db,api,mcp): add users identity substrate — ADR-052 D6 (#381) #462.
• Role vocabulary + scoped-assignment decisions: feat(db/api): first-class actor identity — users table now, extensible to Revit associations and OAuth/SSO (#43 substrate) #381 round 4 (2026-07-06, thewrz); ADR-052.

Acceptance

• Grant/revoke/list round-trips per scope; duplicate grant idempotent or 409 (decide + document); cross-scope leakage impossible (XOR enforced end-to-end).
• Both contract gates green; unit + targeted integration green.

Sequenced after PR #462 merges. Blocks #382; feeds #380/#377 enforcement points.

🤖 Filed by Claude Fable 5 · #381 scope-split follow-up (ADR-052 D7)