restoreUser must regrant roles after MARS-382 soft-delete cascade (role-less restore gap)

MARS-382 follow-up (audit-mandated): migration 051's AFTER UPDATE cascade soft-deletes userRoles when a user is soft-deleted, but restoreUser only clears users.deletedAt — post-cascade that leaves a role-LESS/broken account (userRoles has no deletion provenance, so no auto-restore-cascade by design). restoreUser must atomically require/regrant an explicit role set, or block reactivation until roles are chosen. Coupled to MARS-382's push (same file likely).