feat: add Role (owner|admin) to the user domain, persistence model and mapper

features/user_response_field_hygiene.feature

@@ -7,8 +7,8 @@ Feature: API responses never expose a user's secret fields
     credential or a still-valid reset/verification secret
 
   Background:
-    Given the public shape of a user in any API response is exactly seven fields: id, username,
-      email, is_verified, created_at, updated_at and display_name
+    Given the public shape of a user in any API response is exactly eight fields: id, username,
+      email, is_verified, created_at, updated_at, display_name and role
     And password, password_reset_code, verification_code, verification_expiration,
       password_reset_expiration and token_version never appear in any response body, under any key
       name, regardless of their value or whether they are set
@@ -21,7 +21,7 @@ Feature: API responses never expose a user's secret fields
     When the client sends POST /v1/auth/verify with body {"code": "abc123"}
     Then the response status is 200
     And the response body is a JSON object with exactly the keys id, username, email,
-      is_verified, created_at, updated_at and display_name
+      is_verified, created_at, updated_at, display_name and role
     And the response body does not contain the keys password, password_reset_code,
       verification_code, verification_expiration, password_reset_expiration or token_version
     And the response body's is_verified is true