feat: add Role (owner|admin) to the user domain, persistence model and mapper

features/accept_invitation.feature

@@ -26,7 +26,8 @@ Feature: An invited person accepts their invitation and gets a verified account
     And error responses are plain text from http.Error, success responses are JSON
     And accepting creates a user with the invite's email (already lower case), the chosen username,
       the hashed password, is_verified true, an empty verification code, and an empty display name
-    And the created user has the same access as any other verified user: no roles, no ownership
+    And the created user is an admin: same access to articles, the users list and Settings, but
+      cannot invite
     And the jwt cookie is set exactly as registration sets it: HttpOnly, path "/", 24 hours, with
       claims user_id and token_version, and Secure in production