fix(tests): adapt permission tests to new RBAC architecture

- Add Role records for editor, viewer, guest in seed_full_data
- Link UserTenant.role_id to Role records (legacy string roles no longer grant permissions)
- Fixes 10 test failures caused by removal of Legacy Role Bypass
- All 33 tests now pass

tests/test_permission_system_live.py

@@ -222,6 +222,31 @@ async def seed_full_data(db: AsyncSession) -> dict[str, Any]:
     db.add_all([tenant_a, tenant_b])
     await db.flush()
 
+    # Default roles (new RBAC architecture requires role_id for permissions)
+    editor_role = Role(
+        tenant_id=tenant_a.id,
+        name="editor",
+        permissions={"contacts": {"read": True, "write": True, "delete": False}},
+        denied_permissions=[],
+        field_permissions={},
+    )
+    viewer_role = Role(
+        tenant_id=tenant_a.id,
+        name="viewer",
+        permissions={"contacts": {"read": True, "write": False, "delete": False}},
+        denied_permissions=[],
+        field_permissions={},
+    )
+    guest_role = Role(
+        tenant_id=tenant_a.id,
+        name="guest",
+        permissions={"contacts": {"read": True}},
+        denied_permissions=[],
+        field_permissions={},
+    )
+    db.add_all([editor_role, viewer_role, guest_role])
+    await db.flush()
+
     # Users
     admin_a = User(
         email="admin@tenanta.com",
@@ -274,13 +299,13 @@ async def seed_full_data(db: AsyncSession) -> dict[str, Any]:
 
     # User-tenant memberships
     ut1 = UserTenant(user_id=admin_a.id, tenant_id=tenant_a.id, is_default=True, role="admin")
-    ut2 = UserTenant(user_id=editor_a.id, tenant_id=tenant_a.id, is_default=True, role="editor")
+    ut2 = UserTenant(user_id=editor_a.id, tenant_id=tenant_a.id, is_default=True, role="editor", role_id=editor_role.id)
-    ut3 = UserTenant(user_id=viewer_a.id, tenant_id=tenant_a.id, is_default=True, role="viewer")
+    ut3 = UserTenant(user_id=viewer_a.id, tenant_id=tenant_a.id, is_default=True, role="viewer", role_id=viewer_role.id)
     ut4 = UserTenant(user_id=admin_b.id, tenant_id=tenant_b.id, is_default=True, role="admin")
     # Admin A is also member of tenant B (multi-tenant)
     ut5 = UserTenant(user_id=admin_a.id, tenant_id=tenant_b.id, is_default=False, role="admin")
     # Guest tenant membership with role=guest
-    ut6 = UserTenant(user_id=guest_a.id, tenant_id=tenant_a.id, is_default=True, role="guest")
+    ut6 = UserTenant(user_id=guest_a.id, tenant_id=tenant_a.id, is_default=True, role="guest", role_id=guest_role.id)
     db.add_all([ut1, ut2, ut3, ut4, ut5, ut6])
     await db.flush()