Multi-role members, round detail UI overhaul, dashboard jury progress, and submit bug fix

- Add roles UserRole[] to User model with migration + backfill from existing role column
- Update auth JWT/session to propagate roles array with [role] fallback for stale tokens
- Update tRPC hasRole() middleware and add userHasRole() helper for inline role checks
- Update ~15 router inline checks and ~13 DB queries to use roles array
- Add updateRoles admin mutation with SUPER_ADMIN guard and priority-based primary role
- Add role switcher UI in admin sidebar and role-nav for multi-role users
- Remove redundant stats cards from round detail, add window dates to header banner
- Merge Members section into JuryProgressTable with inline cap editor and remove buttons
- Reorder round detail assignments tab: Progress > Score Dist > Assignments > Coverage > Jury Group
- Make score distribution fill full vertical height, reassignment history always open
- Add per-juror progress bars to admin dashboard ActiveRoundPanel for EVALUATION rounds
- Fix evaluation submit bug: use isSubmitting state instead of startMutation.isPending

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/trpc.ts

@@ -52,6 +52,15 @@ const isAuthenticated = middleware(async ({ ctx, next }) => {
   })
 })
 
+/**
+ * Helper to check if a user has any of the specified roles.
+ * Checks the roles array first, falls back to [role] for stale JWT tokens.
+ */
+export function userHasRole(user: { role: UserRole; roles?: UserRole[] }, ...checkRoles: UserRole[]): boolean {
+  const userRoles = user.roles?.length ? user.roles : [user.role]
+  return checkRoles.some(r => userRoles.includes(r))
+}
+
 /**
  * Middleware to require specific role(s)
  */
@@ -64,7 +73,12 @@ const hasRole = (...roles: UserRole[]) =>
       })
     }
 
-    if (!roles.includes(ctx.session.user.role)) {
+    // Use roles array, fallback to [role] for stale JWT tokens
+    const userRoles = ctx.session.user.roles?.length
+      ? ctx.session.user.roles
+      : [ctx.session.user.role]
+
+    if (!roles.some(r => userRoles.includes(r))) {
       throw new TRPCError({
         code: 'FORBIDDEN',
         message: 'You do not have permission to perform this action',