Add curator roles/permissions with Users admin, and fix lineage branch joins.

Staff accounts use admin/curator roles and fine-grained flags; transitions connect source-to-target with color gradients and stream cutout masks so overlaps stay seamless.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/reset-curator-password.js

@@ -1,5 +1,5 @@
 /**
- * Upsert the curator account password from .env CURATOR_USERNAME / CURATOR_PASSWORD.
+ * Upsert the bootstrap admin account password from .env CURATOR_USERNAME / CURATOR_PASSWORD.
  * Use when login fails after changing .env, or after a DB restore with a different hash.
  *
  *   npm run dev:reset-curator
@@ -8,6 +8,16 @@ require('dotenv').config();
 const bcrypt = require('bcryptjs');
 const pool = require('../server/db');
 
+const ADMIN_PERMISSIONS = [
+  'images',
+  'checkup',
+  'curator_notes',
+  'translations',
+  'influences',
+  'tours',
+  'users',
+];
+
 async function main() {
   const username = (process.env.CURATOR_USERNAME || 'curator').trim();
   const password = process.env.CURATOR_PASSWORD;
@@ -21,17 +31,23 @@ async function main() {
   ]);
 
   if (rows.length === 0) {
-    await pool.query(`INSERT INTO users (username, password_hash) VALUES ($1, $2)`, [
-      username,
-      passwordHash,
-    ]);
-    console.log(`Created curator account: ${username}`);
+    await pool.query(
+      `INSERT INTO users (username, password_hash, role, permissions, is_active)
+       VALUES ($1, $2, 'admin', $3::text[], true)`,
+      [username, passwordHash, ADMIN_PERMISSIONS]
+    );
+    console.log(`Created admin account: ${username}`);
   } else {
-    await pool.query(`UPDATE users SET password_hash = $2 WHERE id = $1`, [
-      rows[0].id,
-      passwordHash,
-    ]);
-    console.log(`Updated password for curator account: ${username}`);
+    await pool.query(
+      `UPDATE users
+       SET password_hash = $2,
+           role = 'admin',
+           permissions = $3::text[],
+           is_active = true
+       WHERE id = $1`,
+      [rows[0].id, passwordHash, ADMIN_PERMISSIONS]
+    );
+    console.log(`Updated password and admin role for account: ${username}`);
   }
 
   // Drop stale sessions so a fresh login is required.