feat(rbac): role types and per-person org chart nodes

Roles gain a coarse type (system | organization, default organization)
validated via Role::TYPES, exposed through resources/chart payload/CSV
export (نوع نقش column), editable in the role form; the seeder marks
admin/system.administrator as system.

In the کاربران chart view every role renders person-style nodes - one per
member for multi-user roles with replicated supervision edges, a «بدون
کاربر» placeholder card for memberless roles (previously dropped from the
chart entirely). The chart is organization-only by rule so system roles
stay out of the structure; collapse/focus remain role-keyed.

Also fixes the shared roles-list query cache: three queryFns wrote
different shapes under the same key, crashing UserRoleManager with an
allRoles.filter TypeError depending on mount order - useRoles() now owns
roleKeys.listAll() and RoleForm/RoleSelect consume it.

BREAKING CHANGE: requires migrate:fresh --seed (roles.type added to the
original authorization migration).