feat: add Role (owner|admin) to the user domain, persistence model and mapper

features/get_current_user.qa.md

@@ -37,13 +37,13 @@ wiring pattern in `test/stale_token_invalidation_http_test.go`.
 ## HTTP-level checks
 
 8. Seed `mockUserRepo` with user id 7, username "alice", email "alice@example.com",
-   `IsVerified: true`, `TokenVersion: 0`. Mint a cookie for user 7 with `token_version: 0`.
-   `GET /v1/auth/me` → assert status `200`, `Cache-Control` header equals `"no-store"`, and the
-   decoded JSON body has `id: 7`, `username: "alice"`, `email: "alice@example.com"`,
-   `is_verified: true`.
-9. Seed user id 8, username "bob", email "bob@example.com", `IsVerified: false`,
+   `IsVerified: true`, `Role: owner`, `TokenVersion: 0`. Mint a cookie for user 7 with
+   `token_version: 0`. `GET /v1/auth/me` → assert status `200`, `Cache-Control` header equals
+   `"no-store"`, and the decoded JSON body has `id: 7`, `username: "alice"`,
+   `email: "alice@example.com"`, `is_verified: true`, `role: "owner"`.
+9. Seed user id 8, username "bob", email "bob@example.com", `IsVerified: false`, `Role: owner`,
    `TokenVersion: 0`. Mint a matching cookie. `GET /v1/auth/me` → assert status `200` (not 403),
-   `Cache-Control: no-store`, and `is_verified: false` in the body.
+   `Cache-Control: no-store`, `is_verified: false` and `role: "owner"` in the body.
 10. No `jwt` cookie at all against the router from step 6 → assert status `401` (produced by
     `jwtauth.Authenticator` itself; don't assert an exact body for this case, same rationale as
     `features/account_verification.qa.md` step 15).