feat: simplify RBAC roles and remove dev role switcher

- Simplified RBAC system to two roles: super_admin and user.
- Removed tenant_admin and rp_admin roles across backend and frontend.
- Removed Dev Role Switcher feature from adminfront.
- Updated all handlers, middlewares, and navigation to reflect the new role model.
- Fixed backend build errors and updated tests.

backend/internal/middleware/rbac_test.go

@@ -64,21 +64,17 @@ func (m *MockKetoService) ListObjects(ctx context.Context, namespace, relation,
 	return args.Get(0).([]string), args.Error(1)
 }
 
-// Fixed MockKetoService to match service.KetoService exactly if possible.
-// Wait, middleware/rbac.go imports baron-sso-backend/internal/service.
-// So I should use service.RelationTuple.
-
 func TestRequireRole_Success(t *testing.T) {
 	app := fiber.New()
 	mockAuth := new(MockAuthProvider)
 	config := RBACConfig{
-		AllowedRoles: []string{"admin"},
+		AllowedRoles: []string{domain.RoleSuperAdmin},
 		AuthHandler:  mockAuth,
 	}
 
 	mockAuth.On("GetEnrichedProfile", mock.Anything).Return(&domain.UserProfileResponse{
 		ID:   "user1",
-		Role: "admin",
+		Role: domain.RoleSuperAdmin,
 	}, nil)
 
 	app.Get("/test", RequireRole(config), func(c *fiber.Ctx) error {
@@ -95,13 +91,13 @@ func TestRequireRole_SetsUserIDForAuditContext(t *testing.T) {
 	app := fiber.New()
 	mockAuth := new(MockAuthProvider)
 	config := RBACConfig{
-		AllowedRoles: []string{"admin"},
+		AllowedRoles: []string{domain.RoleSuperAdmin},
 		AuthHandler:  mockAuth,
 	}
 
 	mockAuth.On("GetEnrichedProfile", mock.Anything).Return(&domain.UserProfileResponse{
 		ID:   "user1",
-		Role: "admin",
+		Role: domain.RoleSuperAdmin,
 	}, nil)
 
 	app.Get("/test", RequireRole(config), func(c *fiber.Ctx) error {
@@ -124,13 +120,13 @@ func TestRequireRole_PreservesExistingUserID(t *testing.T) {
 	app := fiber.New()
 	mockAuth := new(MockAuthProvider)
 	config := RBACConfig{
-		AllowedRoles: []string{"admin"},
+		AllowedRoles: []string{domain.RoleSuperAdmin},
 		AuthHandler:  mockAuth,
 	}
 
 	mockAuth.On("GetEnrichedProfile", mock.Anything).Return(&domain.UserProfileResponse{
 		ID:   "profile-user",
-		Role: "admin",
+		Role: domain.RoleSuperAdmin,
 	}, nil)
 
 	app.Use(func(c *fiber.Ctx) error {
@@ -157,7 +153,7 @@ func TestRequireRole_Forbidden(t *testing.T) {
 	app := fiber.New()
 	mockAuth := new(MockAuthProvider)
 	config := RBACConfig{
-		AllowedRoles: []string{"admin"},
+		AllowedRoles: []string{domain.RoleSuperAdmin},
 		AuthHandler:  mockAuth,
 	}
 
@@ -231,7 +227,7 @@ func TestRequireTenantMatch_Forbidden(t *testing.T) {
 	tenant1 := "tenant1"
 	mockAuth.On("GetEnrichedProfile", mock.Anything).Return(&domain.UserProfileResponse{
 		ID:       "user1",
-		Role:     domain.RoleTenantAdmin,
+		Role:     "user", // Formerly tenant_admin, now mapped to user which is forbidden here for non-superadmin
 		TenantID: &tenant1,
 	}, nil)