[Feature] Role-Based Access Control

At minimum: Admin, Member, and Viewer roles. Admins manage repos and billing, Members can trigger scans and comment on findings, Viewers can only read reports (think external auditors).