Adopt the shared role registry #251

What happens

AlphOne keeps its own copy of a role registry. It cannot take authkit 0.19 or later (#230, #232), because those releases expect the shared registry for invites and admin writes. The graph changes a role or disables an account with a plain write, so a role that moved between the check and the write goes unnoticed.

What should happen

• Roles and capabilities come from the shared role registry. The core declares admin and member. Each plugin declares its roles, and a new capability starts with the plugin id.
• authkit receives the registry, so an invite or an admin change refuses an unknown role (role_unknown) and a role beyond the actor's reach (role_beyond_reach).
• The graph's role and disable writes fail with role_changed when the account's role moved in between.
• An account whose role nobody declares any more can have its role changed or be disabled, but is re-enabled only once it holds a declared role.
• The admin screens read the capabilities the session carries, and the Users menu entry needs manage_users.

Notes

Takes the authkit and authkit/postgres updates of #230 and #232.