feat: 3-tier role system across all platform apps

Portal:
- Replace is_admin boolean with role column (admin/advanced/standard)
- Settings UI: 3-tier portal role select + per-app role dropdowns
- /portal-return endpoint: re-establishes session from JWT for sub-app back-links
- /api/internal/nv-users: internal endpoint for NetworkView user sync
- portal/migrate_roles.py: one-time DB migration script
- Role badges (admin/advanced/standard) in topbar and settings table

DigiServer:
- Add editor and viewer roles (portal advanced->editor, standard->viewer)
- PlaylistPermission model: grant viewer users edit access to specific playlists
- app/utils/access.py: shared editor_required, admin_required, can_edit_playlist helpers
- Content routes: editor_required on create/delete, per-playlist permission check on mutations
- Admin: playlist_permissions route + template to manage viewer playlist grants
- Base template: hide Admin nav for viewers, Portal button (⬡) returns to portal
- content_list_new: hide create/delete for viewers; Manage vs View button per permission
- manage_playlist_content: view-only mode when user lacks edit permission

NetworkView:
- backend/src/middleware/rbac.js: requireRole + requireWriteAccess helpers
- site_permissions table: one site per advanced user
- All mutating routes guarded (admin=all, advanced=assigned site, viewer=read-only)
- Portal SSO auto-upsert: user row synced from X-Auth-Role on every request
- GET /api/users: merges portal users list with local NV data (all 4 portal users visible)
- GET/PUT /api/users/:id/site-permission: assign site to advanced user
- Settings Users tab: role badges, site dropdown for advanced, (portal only) indicator
- Sidebar: ⬡ Portal button between Settings and Logout
- Frontend build: VITE_API_BASE=/networkview/api now set in start-dev.sh

IT Assets / Server Monitor:
- portal_sso.py updated: map advanced->editor/viewer, standard->readonly
- AdminUser model: add editor role + is_editor property

start-dev.sh

@@ -105,7 +105,7 @@ VITE_CFG="$ROOT/NetworkView/frontend/vite.config.ts"
 if [[ ! -f "$NV_DIST/index.html" ]] \
    || find "$ROOT/NetworkView/frontend/src" -newer "$NV_DIST/index.html" -name "*.ts" -o -name "*.tsx" -o -name "*.css" 2>/dev/null | grep -q .; then
     info "Building NetworkView frontend..."
-    VITE_BASE_PATH=/networkview/ \
+    VITE_BASE_PATH=/networkview/ VITE_API_BASE=/networkview/api \
         npm --prefix "$ROOT/NetworkView/frontend" run build --silent
 fi
 
@@ -309,6 +309,7 @@ http {
             auth_request          /portal-verify;
             auth_request_set      \$auth_user_id  \$upstream_http_x_auth_user_id;
             auth_request_set      \$auth_username \$upstream_http_x_auth_username;
+            auth_request_set      \$auth_role     \$upstream_http_x_auth_role;
 
             proxy_pass            http://nv_backend_upstream/api/;
             proxy_set_header      Host              \$host;
@@ -317,6 +318,7 @@ http {
             proxy_set_header      X-Forwarded-Proto \$scheme;
             proxy_set_header      X-User-Id         \$auth_user_id;
             proxy_set_header      X-Username        \$auth_username;
+            proxy_set_header      X-Auth-Role       \$auth_role;
         }
 
         # NetworkView SPA — served from pre-built dist/
@@ -435,6 +437,8 @@ if module_enabled "networkview"; then
     start_bg "networkview-backend" \
         env PORT=$NV_BACKEND_PORT \
             PORTAL_JWT_SECRET=change-this-jwt-secret-in-production \
+            PORTAL_INTERNAL_URL="http://127.0.0.1:${PORTAL_PORT}" \
+            INTERNAL_SYNC_SECRET="${INTERNAL_SYNC_SECRET:-change-this-internal-secret}" \
             NODE_ENV=development \
             DB_PATH="$ROOT/NetworkView/data/networkview.db" \
         node "$ROOT/NetworkView/backend/src/index.js"