Implement access control

Put roles and permissions on a route. Then stop.

Guardrails

• MUST call validateToken before reading roles or permissions.
• MUST enforce the check on the server at the route. Client checks are UX only.
• MUST return 403 when the required role or permission is missing. Never default to allow.
• MUST mount the validator before requireRole / requirePermission.
• MUST NOT write login, callback, or logout. Name implement-saaskit instead.

Gotchas