Frontend adopts role

[joebon]

Scope. Dashboard reads the new role and routes UI gating through the permission hook.

Acceptance criteria

• Per-user organizations endpoint augmented with role.
• Auth context populated with role per organization.
• useRole(org) and hasPermission(perm, org) hooks shipped.
• Permission tables generated from the backend source into a TypeScript artefact at build time.
• Settings → Members UI: role-change control gated by members:set_role; owner row's role-change and remove-member affordances disabled with tooltip pointing to support.
• Destructive controls disabled when the action would leave the org without admin capability.
• Finance pages migrated from implicit "is admin" check to the permission hook.
• Backend continues to return both role and is_admin.

References. RFC §Phase 4, parent #6646. Depends on #11400.