feat: add role-based access control

packages/db/src/rbac.ts

@@ -0,0 +1,47 @@
+export const permissions = [
+  "dashboard.read",
+  "servers.read",
+  "servers.create",
+  "servers.update",
+  "servers.delete",
+  "services.read",
+  "services.create",
+  "services.update",
+  "services.delete",
+  "domains.read",
+  "domains.create",
+  "domains.update",
+  "domains.delete",
+  "domains.check",
+  "notes.read",
+  "notes.create",
+  "notes.update",
+  "notes.delete",
+  "users.read",
+  "users.assignRoles",
+] as const;
+
+export type Permission = (typeof permissions)[number];
+
+export const roleDefinitions = [
+  {
+    id: "role_admin",
+    name: "Admin",
+    description: "Full access to monitoring data, users, roles, and permissions.",
+    permissions: [...permissions],
+  },
+  {
+    id: "role_editor",
+    name: "Editor",
+    description: "Can create and update monitoring resources, run checks, and read users.",
+    permissions: permissions.filter((permission) => permission !== "users.assignRoles"),
+  },
+  {
+    id: "role_viewer",
+    name: "Viewer",
+    description: "Read-only access to monitoring resources and users.",
+    permissions: permissions.filter((permission) => permission.endsWith(".read")),
+  },
+] as const;
+
+export type RoleName = (typeof roleDefinitions)[number]["name"];