bachirandClaude Sonnet 5
a86875c03c
root (renamed from the default admin/admin account) keeps full, unrestricted access outside any role system. These three cover the actual associates: - user: read-only, 'access content' only -- can browse /lignes and /dashboard, nothing else. - editeur: 'access content' + create/edit any/delete any ligne_comptable content -- can enter and correct accounting lines, no site configuration. - admin: identical permission set to editeur for now (per instruction, actual config permissions to be scoped later). Left the pre-existing "administrator" (is_admin bypass -- too broad) and "content_editor" (generic Standard-recipe scaffolding, permissions unrelated to ligne_comptable) roles untouched but unused; worth pruning later if nothing ends up using them. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>