feat: complete Phase 0 Enterprise IAM

src/db/migrations/postgres/0014_seed_roles_and_permissions.sql

@@ -0,0 +1,35 @@
+-- ── Roles ────────────────────────────────────────────────────────────────────
+
+INSERT OR IGNORE INTO roles (id, name, description) VALUES
+    ('10000000-0000-0000-0000-000000000001', 'admin',  'Full system access'),
+    ('10000000-0000-0000-0000-000000000002', 'editor', 'Can manage content and users'),
+    ('10000000-0000-0000-0000-000000000003', 'viewer', 'Read-only access');
+
+-- ── Permissions ───────────────────────────────────────────────────────────────
+
+INSERT OR IGNORE INTO permissions (id, name, description) VALUES
+    ('20000000-0000-0000-0000-000000000001', 'users:create',  'Create new user accounts'),
+    ('20000000-0000-0000-0000-000000000002', 'users:update',  'Update user accounts'),
+    ('20000000-0000-0000-0000-000000000003', 'users:delete',  'Disable user accounts'),
+    ('20000000-0000-0000-0000-000000000004', 'tokens:create', 'Create API tokens for any user'),
+    ('20000000-0000-0000-0000-000000000005', 'tokens:revoke', 'Revoke API tokens for any user'),
+    ('20000000-0000-0000-0000-000000000006', 'roles:manage',  'Assign and revoke roles'),
+    ('20000000-0000-0000-0000-000000000007', 'audit:view',    'View audit log entries');
+
+-- ── Admin role gets all permissions ──────────────────────────────────────────
+
+INSERT OR IGNORE INTO role_permissions (role_id, permission_id)
+SELECT '10000000-0000-0000-0000-000000000001', id FROM permissions;
+
+-- ── Editor role permissions ───────────────────────────────────────────────────
+
+INSERT OR IGNORE INTO role_permissions (role_id, permission_id) VALUES
+    ('10000000-0000-0000-0000-000000000002', '20000000-0000-0000-0000-000000000001'),
+    ('10000000-0000-0000-0000-000000000002', '20000000-0000-0000-0000-000000000002');
+
+-- ── Default applications ──────────────────────────────────────────────────────
+
+INSERT OR IGNORE INTO applications (id, tenant_id, name, slug, enabled) VALUES
+    ('30000000-0000-0000-0000-000000000001', '00000000-0000-0000-0000-000000000001', 'BZOD',         'bzod',         1),
+    ('30000000-0000-0000-0000-000000000002', '00000000-0000-0000-0000-000000000001', 'ChronoSeal',   'chronoseal',   1),
+    ('30000000-0000-0000-0000-000000000003', '00000000-0000-0000-0000-000000000001', 'nx9-dns',      'nx9-dns',      1);