feat: add RBAC Role enum, storage key, error variant, events, and hel…

[Keengfk]

feat: RBAC — Role enum, storage key, error variant, events, and helpers

Introduces the foundational layer for role-based access control (RBAC) across
the split contract.

What's changed

• types.rs — Added Role enum with four variants: Admin, Creator, Operator,
  Auditor. Admin is a super-role that implies all others.
• storage_keys.rs — Added role_key(address, role_discriminant) persistent
  storage key for per-address role assignments ("role_asn").
• error.rs — Added RoleNotHeld = 33 error variant for unauthorized role access.
• events.rs — Added role_granted and role_revoked event emitters (topics: split
  / role_grt|role_rev / grantee).
• lib.rs — Added role_key, role_discriminant, has_role, and require_role
  internal helpers. has_role treats Role::Admin as a super-role implying all
  others. require_role enforces auth and panics with "RoleNotHeld" if no matching
  role is found.

Remaining work (follow-up)

• grant_role / revoke_role admin-only entry points
• Role gates on create_invoice (Creator or Admin) and release (Operator or
  Admin)
• RBAC tests
• Storage snapshot update

closes #480

[drips-wave]

@Keengfk Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits