Admin access
Temporary role picker for local RBAC shell. Production will use Supabase Auth + MFA (P0-005).