Add roles foundation

[AAdewunmi]

Create a role model and connect users to roles so role-aware access can grow without rewriting identity later.