CR26 — role-function guide for Belén (client deliverable)

Client CR26 (Ayudarg-todo sheet): 'Explicar la función de cada rol y enviar a Belén'. Deliverable = a Spanish role-function guide describing what each role does, for Elazar to upload to the client's CR Google Drive + send to Belén (Catedral de la Fe). Decision context: the role FLOOR is already enforced in-app (getUser() bounces zero-role accounts); above the floor the app is currently FLAT (any roled user can do everything, per-org scoping unwired). Elazar chose option C: ship the client doc describing the role model now, do NOT build tier/scoping enforcement as part of this CR. If tier enforcement is wanted later it's a separate WI (thread orgId into ~5 hasRoleInScope callers + tier gates on actions). PM writes the doc; no app code.