Add business team access controls and customer role filters.

Super-admins can assign Admin; owners/admins manage Editor/Viewer via team/access, and the customers list supports all/customers/managers filtering.

Co-authored-by: Cursor <cursoragent@cursor.com>

database/migrations/057_admin_team_manage.sql

@@ -0,0 +1,13 @@
+-- Business team admins can manage non-admin staff (invite / update / remove).
+-- Owners keep full team.* ; editors/viewers stay without team management.
+
+INSERT INTO role_permissions (role_id, permission_id)
+SELECT r.id, p.id
+FROM roles r
+JOIN permissions p ON p.slug IN (
+  'business.team.invite',
+  'business.team.update',
+  'business.team.remove'
+)
+WHERE r.slug = 'admin'
+ON CONFLICT DO NOTHING;