fix(backend): allow role mocking via query parameter for CSV export downloads

backend/internal/handler/user_handler.go

@@ -548,7 +548,22 @@ func (h *UserHandler) ExportUsersCSV(c *fiber.Ctx) error {
 
 	var requesterRole string
 	var manageableSlugs []string
-	if profile, ok := c.Locals("user_profile").(*domain.UserProfileResponse); ok {
+	
+	profile, _ := c.Locals("user_profile").(*domain.UserProfileResponse)
+	
+	// [New] Support Role Mocking for Download (which doesn't have custom headers)
+	if profile == nil {
+		appEnv := strings.ToLower(os.Getenv("APP_ENV"))
+		isDev := appEnv == "dev" || appEnv == "development" || appEnv == ""
+		mockRole := c.Query("x-test-role")
+		if isDev && mockRole != "" {
+			slog.Info("🔑 [AUTH] Using mock role from query for export", "role", mockRole)
+			requesterRole = mockRole
+			// For tenant_admin, we might need more data, but let's assume super_admin for full export in dev
+		} else {
+			return errorJSON(c, fiber.StatusUnauthorized, "invalid session (trace:export_profile)")
+		}
+	} else {
 		requesterRole = profile.Role
 		if requesterRole == domain.RoleTenantAdmin {
 			for _, t := range profile.ManageableTenants {