feat: Guild Master role — intermediate QA gate between student and admin

[LarytheLord]

Problem

Currently the RBAC system has 3 roles: adventurer, company, admin. The "Guild Master" (senior developer who architects solutions and QA-reviews student output) has no formal role in the system. The admin does everything.

This is fine for Phase 1 (Abi = Guild Master + Admin), but as the team scales, we need a dedicated Guild Master role that can:

• Review student submissions (first QA gate)
• View assigned students and their daily updates
• NOT access company data, payments, or user management
• NOT approve final delivery to client (that stays admin-only)

Phase 2 Requirement

This is NOT needed for Phase 1. Track it for when the team grows beyond 1 operator.

What to Build

1. Add guild_master to UserRole enum

enum UserRole {
  adventurer
  company
  admin
  guild_master  // NEW
}

2. Middleware route access

// Guild Masters can access:
"/dashboard/gm": ["guild_master", "admin"],
"/dashboard/gm/reviews": ["guild_master", "admin"],
"/dashboard/gm/students": ["guild_master", "admin"],

// Guild Masters CANNOT access:
"/admin/*": ["admin"],  // unchanged
"/dashboard/company/*": ["company", "admin"],  // unchanged

3. Two-stage QA flow

Student submits → Assignment: "submitted"
       ↓
Guild Master reviews → Assignment: "pending_admin_review" (if approved by GM)
       ↓  
Admin final review → Assignment: "completed" + XP

The pending_admin_review status already exists. The Guild Master approval moves submission from submitted → pending_admin_review. Admin does the final gate.

4. Guild Master dashboard (/dashboard/gm)

• See students assigned to their quests
• See daily updates from those students
• Review submissions (first pass)
• Cannot see company details or payment info

Technical Notes

• Adding an enum value requires a Prisma migration
• Middleware protectedRoutes map needs new entries
• requireAuth calls throughout the codebase already support multiple roles — just add guild_master where appropriate
• The assignment service needs a "GM approve" endpoint that transitions to pending_admin_review

Acceptance Criteria

• guild_master role exists in DB enum
• GM can log in and see their dashboard
• GM can review submissions (approve → pending_admin_review)
• GM cannot access admin panel or company data
• Admin can still override/approve directly
• Migration runs without data loss on existing users