auth-bundle-1 Phase 9 + 10: approval-bypass closure + RBAC GUI

# Phase 9 — approval-bypass closure (Decision 9, option a)

* Migration 000033_approval_kinds.up.sql: ALTER TABLE
  issuance_approval_requests ADD COLUMN approval_kind +
  payload JSONB; relax certificate_id + job_id to nullable;
  CHECK (approval_kind IN ('cert_issuance','profile_edit'))
  + CHECK (per-kind nullability invariant) + index on
  approval_kind. Idempotent throughout via DO blocks.
* domain.ApprovalKind enum (cert_issuance / profile_edit) +
  IsValidApprovalKind. ApprovalRequest gains Kind +
  Payload []byte for the pending profile diff.
* postgres.ApprovalRepository.Create + scanApprovalRow extended
  to round-trip the new columns; certificate_id + job_id
  switched to sql.NullString so profile_edit rows persist
  cleanly. Default Kind=cert_issuance preserves back-compat
  for every Phase-7-2026-05-03 caller.
* ApprovalService.RequestProfileEditApproval: new entry point
  that creates a pending profile-edit row carrying the
  serialized profile diff. Bypass mode (CERTCTL_APPROVAL_BYPASS)
  short-circuits the same way it does for cert_issuance.
* ApprovalService.SetProfileEditApply hook: cmd/server/main.go
  registers a closure that deserializes req.Payload + persists
  via profileRepo.Update + emits a profile.edit_applied audit
  row with category=auth. The hook avoids the Approval ↔
  Profile import cycle.
* ProfileService.UpdateProfile: gates when (a) the live
  profile carries RequiresApproval=true, OR (b) the proposed
  edit would set it true. Returns ErrProfileEditPendingApproval
  with the new approval ID; ProfileHandler maps to HTTP 202
  Accepted + {pending_approval_id}. Both arms close the
  flip-flop loophole because every transition through an
  approval-tier profile fires the gate.
* TestProfileEdit_RequiresApprovalLoopholeClosed pins all 3
  bypass attempts (flip-off / kept-on / flip-on) gated; nil-
  approval-service preserves pre-Phase-9 direct-apply for
  test fixtures.
* Approval service tests gain 4 profile_edit rows: pending row
  shape; same-actor self-approve rejected with
  ErrApproveBySameActor (load-bearing two-person integrity);
  approve fails-closed when apply callback unwired;
  apply callback invoked on approve.
* docs/reference/profiles.md (new) explains the gate +
  edit response shape (202) + same-actor invariant + bypass
  + audit hooks.

# Phase 10 — RBAC management GUI

* useAuthMe hook (web/src/hooks/useAuthMe.ts): TanStack Query
  fetches /api/v1/auth/me on app boot, caches for 60s, exposes
  hasPerm(p) + hasAnyPerm + isAdmin predicates. Every Phase-10
  page consumes this on mount + gates affordances against the
  cached effective_permissions slice. Server-side enforcement
  is the load-bearing gate; client-side hide/disable is UX.
* New routes:
   - /auth/roles — list (auth.role.list); create-role modal
     (auth.role.create) hidden when missing.
   - /auth/roles/:id — detail + permissions; edit
     (auth.role.edit), delete (auth.role.delete), add/remove
     permission affordances each gated.
   - /auth/keys — list of every actor with role grants; assign
     + revoke modals (auth.role.assign). actor-demo-anon
     flagged system-managed; mutation buttons hidden for it.
   - /auth/settings — stub showing /v1/auth/me identity +
     bootstrap-endpoint availability via /v1/auth/bootstrap.
* AuditPage extended with category filter ('All categories'
  + the 3 enum values from migration 000032). Selection flows
  to the API call params + the URL-driven query state.
* Layout: 3 new nav entries (Roles / API Keys / Auth Settings).
* api/client.ts: 12 new exported functions for the RBAC
  surface (authMe, list/get/create/update/delete role,
  list/add/remove role permissions, list keys, assign/revoke
  key role, bootstrap-availability probe).
* data-testid attributes on every interactive element so a
  future Playwright suite can assert behavior without brittle
  CSS selectors.
* Empty state, error state, and unsaved-changes warnings on
  every form per the prompt's implementation rules.

# Frontend tests

* RolesPage.test.tsx (6 tests): list render, empty state,
  error state, hide-create-button-without-perm,
  show-create-button-with-perm, submit-create-modal.
* KeysPage.test.tsx (3 tests): demo-anon flagged
  system-managed (no buttons), permission-gated affordance
  hide for auditor caller, assign-modal-POST contract.
* AuthSettingsPage.test.tsx (2 tests): identity surface,
  bootstrap-OPEN-status surface.
* AuditPage.test.tsx (+1): category-filter select renders
  with the 4 documented options.

15 frontend tests total in src/pages/auth/ + the audit
category-filter test; all pass via npx vitest run.

# Verifications

* go vet ./... clean.
* staticcheck across internal/auth + handler + router + cli +
  service + repository + cmd + domain: clean.
* gofmt -l clean repo-wide.
* go test -short -count=1 green across internal/service,
  internal/api/handler, internal/api/router, internal/auth,
  internal/auth/bootstrap, internal/service/auth,
  internal/domain/auth, cmd/server, cmd/cli, internal/cli.
* npx tsc --noEmit clean.
* npm run build green (vite build produces dist/index.html
  + 946KB JS bundle; chunk-size warning is pre-existing).
* npx vitest run src/pages/auth/ src/pages/AuditPage.test.tsx
  green (15 tests, 4 files).

internal/repository/postgres/approval.go

@@ -60,19 +60,41 @@ func (r *ApprovalRepository) Create(ctx context.Context, req *domain.ApprovalReq
 		metadataJSON = []byte("{}")
 	}
 
+	// Bundle 1 Phase 9: empty Kind defaults to cert_issuance to
+	// preserve back-compat for every Phase-7-2026-05-03 caller.
+	if req.Kind == "" {
+		req.Kind = domain.ApprovalKindCertIssuance
+	}
+	if !domain.IsValidApprovalKind(req.Kind) {
+		return fmt.Errorf("invalid approval kind %q", req.Kind)
+	}
+
+	// nullable cert_id / job_id for profile_edit rows.
+	var certID, jobID interface{}
+	if req.CertificateID != "" {
+		certID = req.CertificateID
+	}
+	if req.JobID != "" {
+		jobID = req.JobID
+	}
+	var payload interface{}
+	if len(req.Payload) > 0 {
+		payload = req.Payload
+	}
+
 	const q = `
 		INSERT INTO issuance_approval_requests
 			(id, certificate_id, job_id, profile_id, requested_by,
 			 state, decided_by, decided_at, decision_note, metadata,
-			 created_at, updated_at)
+			 created_at, updated_at, approval_kind, payload)
 		VALUES
-			($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+			($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
 	`
 
 	_, err = r.db.ExecContext(ctx, q,
-		req.ID, req.CertificateID, req.JobID, req.ProfileID, req.RequestedBy,
+		req.ID, certID, jobID, req.ProfileID, req.RequestedBy,
 		string(req.State), req.DecidedBy, req.DecidedAt, req.DecisionNote, metadataJSON,
-		req.CreatedAt, req.UpdatedAt,
+		req.CreatedAt, req.UpdatedAt, string(req.Kind), payload,
 	)
 	if err != nil {
 		var pqErr *pq.Error
@@ -89,7 +111,7 @@ func (r *ApprovalRepository) Get(ctx context.Context, id string) (*domain.Approv
 	const q = `
 		SELECT id, certificate_id, job_id, profile_id, requested_by,
 		       state, decided_by, decided_at, decision_note, metadata,
-		       created_at, updated_at
+		       created_at, updated_at, approval_kind, payload
 		FROM   issuance_approval_requests
 		WHERE  id = $1
 	`
@@ -103,7 +125,7 @@ func (r *ApprovalRepository) GetByJobID(ctx context.Context, jobID string) (*dom
 	const q = `
 		SELECT id, certificate_id, job_id, profile_id, requested_by,
 		       state, decided_by, decided_at, decision_note, metadata,
-		       created_at, updated_at
+		       created_at, updated_at, approval_kind, payload
 		FROM   issuance_approval_requests
 		WHERE  job_id = $1
 		ORDER  BY created_at DESC
@@ -131,7 +153,7 @@ func (r *ApprovalRepository) List(ctx context.Context, filter *repository.Approv
 	q := `
 		SELECT id, certificate_id, job_id, profile_id, requested_by,
 		       state, decided_by, decided_at, decision_note, metadata,
-		       created_at, updated_at
+		       created_at, updated_at, approval_kind, payload
 		FROM   issuance_approval_requests
 		WHERE  1 = 1
 	`
@@ -269,16 +291,20 @@ type rowScanner interface {
 func scanApprovalRow(row rowScanner) (*domain.ApprovalRequest, error) {
 	var (
 		req          domain.ApprovalRequest
+		certID       sql.NullString
+		jobID        sql.NullString
 		stateStr     string
 		decidedBy    sql.NullString
 		decidedAt    sql.NullTime
 		decisionNote sql.NullString
 		metadataJSON []byte
+		kindStr      string
+		payload      []byte
 	)
 	err := row.Scan(
-		&req.ID, &req.CertificateID, &req.JobID, &req.ProfileID, &req.RequestedBy,
+		&req.ID, &certID, &jobID, &req.ProfileID, &req.RequestedBy,
 		&stateStr, &decidedBy, &decidedAt, &decisionNote, &metadataJSON,
-		&req.CreatedAt, &req.UpdatedAt,
+		&req.CreatedAt, &req.UpdatedAt, &kindStr, &payload,
 	)
 	if err != nil {
 		if errors.Is(err, sql.ErrNoRows) {
@@ -288,6 +314,16 @@ func scanApprovalRow(row rowScanner) (*domain.ApprovalRequest, error) {
 	}
 
 	req.State = domain.ApprovalState(stateStr)
+	req.Kind = domain.ApprovalKind(kindStr)
+	if certID.Valid {
+		req.CertificateID = certID.String
+	}
+	if jobID.Valid {
+		req.JobID = jobID.String
+	}
+	if len(payload) > 0 {
+		req.Payload = payload
+	}
 	if decidedBy.Valid {
 		s := decidedBy.String
 		req.DecidedBy = &s