Roles & policies

App roles + MySQL grants — not Postgres RLS