fix(ssot): align ADMIN_ROLES + permission vocabulary to tinyland-auth v0.4.0 (TIN-2435 drift)

[Jess Sullivan (Jesssullivan)]

Summary

• ADMIN_ROLES was missing member (7 of the authority's 8 roles). @tummycrypt/tinyland-auth v0.4.0 defines 8 roles: super_admin, admin, moderator, editor, event_manager, contributor, member, viewer. Added member to ADMIN_ROLES and to the duplicated role z.enum([...]) lists in adminUserSchema, createAdminUserSchema, and updateAdminUserSchema (the last of these was also separately missing contributor — fixed for consistency, since all three role enums must mirror ADMIN_ROLES).
• ADMIN_PERMISSIONS / the AdminPermission type carried a dead 'admin.users.moderate' string that does not exist in tinyland-auth v0.4.0's 21-permission vocabulary (src/types/permissions.ts). Removed it from both ADMIN_PERMISSIONS and the AdminPermission union type.
• Added tests/vocabulary-alignment.test.ts asserting ADMIN_ROLES matches the transcribed v0.4.0 authority role list, and that no ADMIN_PERMISSIONS entry falls outside the transcribed 21-permission authority set. Comments reference TIN-2435 and explain this package can only reach @tummycrypt/tinyland-auth at the type level (via the Bazel npm_link_package in BUILD.bazel/MODULE.bazel), not as a runtime npm dependency, so the authority vocabulary is transcribed by hand rather than imported live.
• Updated tests/admin-validation.test.ts assertions that had encoded the stale vocabulary (ADMIN_ROLES length 7 / no member, ADMIN_PERMISSIONS length 9 / includes admin.users.moderate) to match the corrected vocabulary.

Reference: TIN-2435 (SSOT ratification), findings reported against v0.2.3 (src/schemas.ts:19-41, src/types.ts:13-22).

Test plan

• pnpm test (vitest) — 140/140 passing (was 138/138 before this change; +2 new alignment tests)
• Confirmed pre-existing (unrelated) pnpm typecheck failure: tsc cannot resolve @tummycrypt/tinyland-auth outside the Bazel module graph — this predates this change (present at HEAD ea3c8ef) and is unaffected by it.