root (renamed from the default admin/admin account) keeps full,
unrestricted access outside any role system. These three cover the
actual associates:
- user: read-only, 'access content' only -- can browse /lignes and
/dashboard, nothing else.
- editeur: 'access content' + create/edit any/delete any
ligne_comptable content -- can enter and correct accounting lines,
no site configuration.
- admin: identical permission set to editeur for now (per instruction,
actual config permissions to be scoped later).
Left the pre-existing "administrator" (is_admin bypass -- too broad)
and "content_editor" (generic Standard-recipe scaffolding, permissions
unrelated to ligne_comptable) roles untouched but unused; worth
pruning later if nothing ends up using them.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
