TIN-1606: Normalize RBAC management order

[Jess Sullivan (Jesssullivan)]

Summary

• export ADMIN_ROLES and ROLE_MANAGEMENT_ORDER alongside ROLE_HIERARCHY
• make canManageRole() use ROLE_HIERARCHY instead of a private divergent ordering
• document the RBAC distinction: role management order is hierarchical, role permissions are a capability matrix and not strict supersets
• add regression coverage for all roles, role alias normalization, and the event-manager/contributor capability split that broke the downstream PBT assumption

Validation

• pnpm exec tsc --noEmit
• pnpm exec vitest run tests/permissions.test.ts (34 tests)
• pnpm test (15 files, 363 tests)
• pnpm build
• pnpm check:package
• bazel test //:test
• git diff --check

Linear

TIN-1606