feat: 3-tier role system across all platform apps

Portal:
- Replace is_admin boolean with role column (admin/advanced/standard)
- Settings UI: 3-tier portal role select + per-app role dropdowns
- /portal-return endpoint: re-establishes session from JWT for sub-app back-links
- /api/internal/nv-users: internal endpoint for NetworkView user sync
- portal/migrate_roles.py: one-time DB migration script
- Role badges (admin/advanced/standard) in topbar and settings table

DigiServer:
- Add editor and viewer roles (portal advanced->editor, standard->viewer)
- PlaylistPermission model: grant viewer users edit access to specific playlists
- app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers
- Content routes: editor_required on create/delete, per-playlist permission check on mutations
- Admin: playlist_permissions route + template to manage viewer playlist grants
- Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal
- content_list_new: hide create/delete for viewers; Manage vs View button per permission
- manage_playlist_content: view-only mode when user lacks edit permission

NetworkView:
- backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers
- site_permissions table: one site per advanced user
- All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only)
- Portal SSO auto-upsert: user row synced from X-Auth-Role on every request
- GET /api/users: merges portal users list with local NV data (all 4 portal users visible)
- GET/PUT /api/users/:id/site-permission: assign site to advanced user
- Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator
- Sidebar: ⬡ Portal button between Settings and Logout
- Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh

IT Assets / Server Monitor:
- portal_sso.py updated: map advanced->editor/viewer, standard->readonly
- AdminUser model: add editor role + is_editor property

NetworkView/frontend/src/components/Sidebar.tsx

@@ -19,6 +19,7 @@ export default function Sidebar() {
   const [loading, setLoading] = useState(true);
   const [addSiteName, setAddSiteName] = useState('');
   const [showAddSite, setShowAddSite] = useState(false);
+  const [addSiteErr, setAddSiteErr] = useState<string | null>(null);
   const navigate = useNavigate();
   const location = useLocation();
 
@@ -74,11 +75,16 @@ export default function Sidebar() {
   const handleAddSite = async (e: React.FormEvent) => {
     e.preventDefault();
     if (!addSiteName.trim()) return;
-    const site = await api.createSite({ name: addSiteName.trim() });
-    setAddSiteName('');
-    setShowAddSite(false);
-    await loadTree();
-    navigate(`/sites/${site.id}`);
+    setAddSiteErr(null);
+    try {
+      const site = await api.createSite({ name: addSiteName.trim() });
+      setAddSiteName('');
+      setShowAddSite(false);
+      await loadTree();
+      navigate(`/sites/${site.id}`);
+    } catch (ex: unknown) {
+      setAddSiteErr(ex instanceof Error ? ex.message : String(ex));
+    }
   };
 
   useEffect(() => {
@@ -147,18 +153,21 @@ export default function Sidebar() {
         </div>
 
         {showAddSite && (
-          <form onSubmit={handleAddSite} className="inline-add-form">
-            <input
-              autoFocus
-              type="text"
-              placeholder="Site name..."
-              value={addSiteName}
-              onChange={e => setAddSiteName(e.target.value)}
-              className="inline-input"
-            />
-            <button type="submit" className="inline-btn">Add</button>
-            <button type="button" className="inline-btn secondary" onClick={() => setShowAddSite(false)}>✕</button>
-          </form>
+          <>
+            <form onSubmit={handleAddSite} className="inline-add-form">
+              <input
+                autoFocus
+                type="text"
+                placeholder="Site name..."
+                value={addSiteName}
+                onChange={e => setAddSiteName(e.target.value)}
+                className="inline-input"
+              />
+              <button type="submit" className="inline-btn">Add</button>
+              <button type="button" className="inline-btn secondary" onClick={() => { setShowAddSite(false); setAddSiteErr(null); }}>✕</button>
+            </form>
+            {addSiteErr && <div className="inline-error">{addSiteErr}</div>}
+          </>
         )}
 
         {loading && <div className="sidebar-loading">Loading...</div>}
@@ -229,6 +238,13 @@ export default function Sidebar() {
         <Link to="/settings" className={`sidebar-footer-link ${isActive('/settings') ? 'active' : ''}`}>
           ⚙ Settings
         </Link>
+        <a
+          href="/portal-return"
+          className="sidebar-footer-link"
+          title="Back to Enterprise Portal"
+        >
+          ⬡ Portal
+        </a>
         <button
           className="sidebar-footer-link sidebar-logout-btn"
           onClick={() => { window.location.href = (import.meta.env.VITE_PORTAL_LOGOUT_URL as string | undefined) ?? '/logout'; }}