Add curator roles/permissions with Users admin, and fix lineage branch joins.

Staff accounts use admin/curator roles and fine-grained flags; transitions connect source-to-target with color gradients and stream cutout masks so overlaps stay seamless.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/migrate.js

@@ -17,6 +17,17 @@ const INCREMENTAL_MIGRATIONS = [
   'migrate-i18n.sql',
   'migrate-tours.sql',
   'migrate-curator-notes.sql',
+  'migrate-user-roles.sql',
+];
+
+const BOOTSTRAP_ADMIN_PERMISSIONS = [
+  'images',
+  'checkup',
+  'curator_notes',
+  'translations',
+  'influences',
+  'tours',
+  'users',
 ];
 
 async function bootstrapCurator() {
@@ -36,10 +47,11 @@ async function bootstrapCurator() {
   const bcrypt = require('bcryptjs');
   const passwordHash = await bcrypt.hash(password, 10);
   await pool.query(
-    `INSERT INTO users (username, password_hash) VALUES ($1, $2)`,
-    [username, passwordHash]
+    `INSERT INTO users (username, password_hash, role, permissions, is_active)
+     VALUES ($1, $2, 'admin', $3::text[], true)`,
+    [username, passwordHash, BOOTSTRAP_ADMIN_PERMISSIONS]
   );
-  console.log(`  bootstrap curator account: ${username}`);
+  console.log(`  bootstrap admin account: ${username}`);
 }
 
 async function applySqlFile(label, filePath) {