Splits the previously single-role Ability class along role boundaries.
Admin keeps full account management. Editor gets CRUD on templates,
folders, submissions, submitters, and template sharings, but cannot
touch users, account settings, encrypted configs, webhooks, or MCP.
Viewer gets read-only access to the same content surface. Every role
keeps self-service on their own User / UserConfig / AccessToken.
UsersController#index gains a one-line admin guard so non-admins
cannot reach the user list via the self-manage rule's class-level
CanCan check.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>