feat(analytics): allow every staff role to view dashboard

[compaii]

1|## Summary
2|
3|- make Analytics view-only access the default for every authenticated Live staff role
4|- preserve export access for Admin and active EXPORTER grants only
5|- keep revoked exporter grants at the baseline view-only permission
6|- update analytics architecture, governance, and operations documentation
7|
8|## Verification
9|
10|- npx vitest run src/lib/__tests__/analytics-access.test.ts --reporter=verbose
11| - RED before implementation: 4 expected authorization failures
12| - GREEN after implementation: 6/6 passed
13|- npm test: 1116 passed, 25 skipped
14|- npx tsc --noEmit: passed
15|- npm run lint: passed
16|- npm run build: passed
17|- independent security/logic review: passed with no findings on dde9031e6859d7453206c5cdb757ca74596e662d
18|
19|## Security boundary
20|
21|This does not expand CSV export privileges. ANALYTICS_VIEWER continues to receive 403 export_forbidden for CSV requests; only ADMIN and an active EXPORTER grant can export.
22|
23|## Deployment note
24|
25|Current production staff received explicit VIEWER grants as the supported immediate path. No merge or deploy should proceed while repository gates are red.
26|
27|The exact PR head currently reproduces two pre-existing release blockers unrelated to this five-file diff:
28|
29|1. lint-and-build: the production dependency audit rejects fast-uri and mysql2 advisories. The same dependency baseline is present on release; this PR changes no dependency files.
30|2. analytics: services/analytics/test/postgres.test.mjs:229 fails in quality run records canonical integrity and storage samples (false !== true). The identical test and assertion failed in PR #493 before this branch existed. A single rerun reproduced it.
31|
32|Passing GitHub checks on this head: test, e2e, and frozen-audio-paths.
33|

[nicoechaniz]

Closing this implementation path after the resumed #474 completion audit. The epic contract requires dashboard access to remain limited to ADMIN and explicit analytics roles; automatically granting every present and future staff role would broaden that boundary.

The four current staff members already have explicit active VIEWER grants in production, so their requested view-only access remains intact, and exports remain limited to ADMIN/EXPORTER. PR #499 separately repairs the inherited release CI gates without changing access semantics.