Document Task/EventRule/EventSource/RBAC-role/company-membership API endpoints

These were previously undocumented because they either 501'd (no
concrete server class) or silently fell into DefaultApi due to missing
OpenAPI tags - now fixed in multiflexi-server/multiflexi-api.

Also disambiguate the two independent RBAC-adjacent mechanisms in
concepts/rbac.rst: company_user (per-company membership/role, what
that page documents) vs. rbac_roles/rbac_user_roles (system-wide
roles, newly formalized as a migration and exposed via
/user/{userId}/roles/) - they're easy to conflate but are separate,
independently maintained systems.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Vitexus

source/concepts/rbac.rst

@@ -467,6 +467,25 @@ Page Shows "Access Denied" When It Shouldn't
 
 ---
 
+Relationship to system-wide RBAC roles
+---------------------------------------
+
+.. note::
+
+   Everything above describes **company membership** (the ``company_user``
+   table): which companies a user can see, with a simple per-company role
+   (``viewer``/``manager``/``admin``). It is managed via
+   ``POST /company/{companyId}/user/`` and ``DELETE
+   /company/{companyId}/user/{userId}``.
+
+   MultiFlexi separately has **system-wide RBAC roles** (``rbac_roles`` /
+   ``rbac_user_roles``, e.g. ``super_admin``, ``admin``, ``editor``,
+   ``user``, ``viewer``), assigned independently of company membership via
+   ``multiflexi-cli user-role:set`` or ``POST /user/{userId}/roles/``. These
+   are two distinct, independently maintained mechanisms — a user's
+   system-wide role does not imply company access, and company membership
+   does not grant any system-wide role.
+
 See Also
 --------
 

source/reference/api.rst

@@ -83,6 +83,57 @@ This endpoint allows you to manage topics. You can retrieve and update topics.
 - **POST /topic/{topicId}.{suffix}**: Update Topic
 - **GET /topics.{suffix}**: Get All Topics
 
+/task/
+------
+This endpoint exposes :doc:`Tasks <../concepts/tasks>` — the per-scheduling-window
+obligation record derived from a RunTemplate's interval, holding one or more
+Job attempts.
+
+- **GET /task/{taskId}.{suffix}**: Get Task by ID, including its embedded job
+  attempt history
+- **GET /tasks.{suffix}**: List Tasks, optionally filtered by ``state``,
+  ``runtemplate_id``, ``from``, and ``to``
+
+/eventrule/
+-----------
+This endpoint manages EventRules — the event-to-RunTemplate mapping used to
+chain a RunTemplate's completion into scheduling another one.
+
+- **GET /eventrule/{eventRuleId}.{suffix}**: Get EventRule by ID
+- **POST /eventrule/**: Create or Update EventRule
+- **DELETE /eventrule/{eventRuleId}.{suffix}**: Delete EventRule by ID
+- **GET /eventrules.{suffix}**: Show All EventRules
+
+/eventsource/
+-------------
+This endpoint manages EventSources — webhook adapter database connections
+that EventRules can react to.
+
+- **GET /eventsource/{eventSourceId}.{suffix}**: Get EventSource by ID
+- **POST /eventsource/**: Create or Update EventSource
+- **DELETE /eventsource/{eventSourceId}.{suffix}**: Delete EventSource by ID
+- **GET /eventsources.{suffix}**: Show All EventSources
+- **POST /eventsource/{eventSourceId}/test.{suffix}**: Test whether the
+  adapter database is reachable
+
+/user/{userId}/roles/
+----------------------
+This endpoint manages RBAC role assignments for a user.
+
+- **GET /user/{userId}/roles.{suffix}**: Get the RBAC roles assigned to a user
+- **POST /user/{userId}/roles/**: Set (replace or extend, via the ``replace``
+  query parameter) the RBAC roles assigned to a user
+
+/company/{companyId}/user/
+---------------------------
+This endpoint manages company membership — which users have access to a
+company and with what role.
+
+- **GET /company/{companyId}/users.{suffix}**: List users assigned to a
+  company, with their roles
+- **POST /company/{companyId}/user/**: Assign a user to a company (upsert)
+- **DELETE /company/{companyId}/user/{userId}**: Remove a user from a company
+
 Other Endpoints
 ===============