Role-based permissions for client members and internal team

Introduce role-based access levels and customizable permissions for both internal team members and client-organization members. Asks include: client-org admins vs staff (admins manage members, assign brands, view reports); per-request visibility so users only see requests they submitted; permission to mark requests complete, edit files, etc.; and a fuller hierarchy (Admin / Manager / Staff / Client) with configurable permissions.