Problem

The authenticate middleware read user.user_metadata?.role from the JWT but
never attached it to req.user, so no route or middleware could check it. Any
authenticated user — regardless of role — could perform destructive operations
like deleting subscriptions or managing team members.

Changes

middleware/auth.ts

• Exported UserRole type ('owner' | 'admin' | 'member' | 'viewer')
• Added role: UserRole to AuthenticatedRequest.user
• Both authenticate and optionalAuthenticate now extract the role from JWT
  user_metadata, validate it, and attach it to req.user (defaults to 'member' if
  absent or unrecognized)

middleware/rbac.ts (new)

• ROLE_PERMISSIONS map defining permission scope per role
• requireRole(...roles: UserRole[]) middleware factory — returns 403 if the
  caller's JWT role is not in the allowed list

routes/subscriptions.ts

• DELETE /:id — now requires owner or admin
• POST /bulk — now requires owner or admin

routes/team.ts

• POST /invite — now requires owner or admin
• GET /pending — now requires owner or admin
• PUT /:memberId/role — now requires owner
• DELETE /:memberId — now requires owner or admin

Notes

• Team routes retain their existing DB-level canManageTeam() / isOwner checks
  as a second layer of defense
• requireRole runs before any DB query, failing fast at the JWT level
• Unknown or missing roles in the JWT default to 'member' (least privilege)

Acceptance Criteria

• Role hierarchy defined (owner > admin > member > viewer)
• requireRole middleware created
• All destructive operations require owner or admin
• Team management endpoints enforce owner-only or owner/admin actions
  close User roles/RBAC is a stub — role field is read from JWT but never enforced in any route #134