[systemicdream]

Summary

Lets operators designate accounts as IT accounts (stored role TECHNICIAN) that are distinct from regular user accounts, and adds a single server-side guard that future IT-only abilities can reuse. No new IT abilities are added yet.

Related issue

Closes #55

What changed

• pnpm user:set-role interactively promotes an existing account to TECHNICIAN or demotes it to USER, backed by a new AuthRepository.setUserRole. Role parsing is shared with pnpm user:create.
• New requireTechnician guard (apps/api/src/auth/require-technician.ts) resolves the role from the server-side session on every request; the assignment route now uses it with unchanged 401/403 responses. Role changes apply on the next request without revoking sessions.
• The account menu shows an "IT" badge for IT accounts; the accessible label becomes "Account: Signed in as (IT)".
• ADR-006, a spec, and a plan record the decision. README documents creating and upgrading IT accounts (command line only), and AGENTS.md lists the new command.

Validation

• Added or updated tests where behavior changed: repository promote/demote/unknown-user integration tests, demoted-session 403 route test, parseUserRole unit tests, badge component tests.
• Ran relevant local checks: format, lint, typecheck, migrate, test, coverage, build, smoke, and git diff --check in the pinned toolchain.
• Verified the primary user flow: ran user:set-role against a local database (promote, demote, invalid role, unknown user), and checked the badge in a browser for IT and regular accounts at desktop and 375px widths.

Screenshots or recordings

The IT badge appears next to "Signed in" in the header account button for IT accounts at desktop and mobile widths; regular accounts are unchanged.

Review notes

• The stored role stays TECHNICIAN; "IT" is the product label. Renaming the enum was rejected to avoid a migration and an API contract change (see ADR-006).
• Role changes are command-line only; an in-app role manager needs an admin role and is deferred.
• No migration is required.