feat: granular RBAC system with user groups, deny-list, permission registry, system-admin, self-mod prevention

app/models/user.py

@@ -35,6 +35,9 @@ class User(Base, TenantMixin):
     )
     is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)
     preferences: Mapped[dict[str, Any]] = mapped_column(JSONB, default=dict, nullable=False)
+    is_system_admin: Mapped[bool] = mapped_column(
+        Boolean, default=False, nullable=False, server_default="false"
+    )
 
 
 class UserTenant(Base):
@@ -49,6 +52,12 @@ class UserTenant(Base):
         PGUUID(as_uuid=True), ForeignKey("tenants.id", ondelete="CASCADE"), primary_key=True
     )
     is_default: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    role_id: Mapped[uuid.UUID | None] = mapped_column(
+        PGUUID(as_uuid=True),
+        ForeignKey("roles.id", ondelete="SET NULL"),
+        nullable=True,
+        index=True,
+    )
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )