Why: Backend needs a single trusted catalog and durable role authority before RDM can stop owning position data.
Evidence: Authz catalog tests and the full store suite passed on SQLite; migration rollback and one-active-role constraints are covered.
Impact: Adds schema v35 and stable role/binding types without changing existing authorization callers.
Refs: Focused role and permission system task 1