Add role-based access control (RBAC)

[jzonthemtn]

Summary

Arbiter has no documented role-based access control. In regulated environments, different reviewers need different permission levels (e.g., view-only, review, admin).

Proposal

Add RBAC:

• Define roles (viewer, reviewer, admin) with configurable permissions
• Restrict document access by role or team
• Audit log of who reviewed what and when
• Integration with external identity providers (LDAP, OIDC)

Acceptance Criteria

• Roles defined: reviewer, senior reviewer, admin
• Reviewers can only act on documents assigned to them
• Senior reviewers can adjudicate and reassign
• Admins can manage users, roles, and configuration
• Role assignments stored and enforced server-side
• Tests cover permission enforcement for each role