Role editor

What each role may do, as a grid: roles across, permissions down, grouped by area, with the rows an AI workspace needs: which models a role may call and what one member may spend a month. Built-in roles are locked and a new role starts as a copy of any of them. Edits wait in a draft that marks every changed cell and says how many members it reaches before Save. roleCheck enforces the same rules in an AI SDK route.