Implement complete RBAC (Role-Based Access Control) system

[Josue19-08]

🔖 Title

Implement complete RBAC (Role-Based Access Control) system

---

📄 Description

There is currently no authorization layer in the API — only JwtAuthGuard (authentication) exists. The users table has no role column, and there are no @Roles decorators or RolesGuard anywhere in src/. This blocks admin-only operations (loan overrides, merchant approval, system health) and any endpoint that should be restricted by user type.

Also fix a related bug found during investigation: GET /reputation/me (src/modules/reputation/reputation.controller.ts) reads req.user?.wallet but has no @UseGuards(JwtAuthGuard), leaving it unprotected.

---

✅ Tasks to complete

• Migration: add role enum column to users (admin, merchant, lp-provider, borrower)
• UserRole enum + @Roles() decorator + RolesGuard
• Apply guards/decorators across all existing protected endpoints
• Admin routes: loan override, merchant approval, system health endpoint
• Fix missing @UseGuards(JwtAuthGuard) on GET /reputation/me
• Unit tests for guard/decorator logic
• Integration tests covering allowed/denied access per role for each protected route
• Update Swagger with role requirements per endpoint

---

📚 Documentation/context for AI

(This link never should removed)
https://github.com/TrustUp-app/TrustUp-API/tree/main/docs

---

🗒️ Additional notes

No role field or RBAC infrastructure exists today — this is greenfield work, not an extension of an existing system.