Remaining agent ops on the internal support surface: roles/user/flags/jtp-reassign + access-request trio (blocked on Elazar)

Carried out of MARS-759 on its close. MARS-759 filed 8 agent ops on the internal support surface; three shipped (access-list, user-lookup in v2.80.0; assignment-set in v2.85.0, SHA 8af29f8). These six were named in the item and are explicitly OUTSIDE the 2026-09-28 GO, whose scope was assignment-set only: user-roles-set, user-create, user-restore, user-flags, jtp-reassign, and the access-request trio access-approve / access-reject / access-request-info. BLOCKED on Elazar's decision, same as they were under MARS-759 - do not build any of them on this item alone. Each is Class-A (auth/permission gates, and user-create touches the no-auto-account-creation rule), so each needs an audit design-ping before implementing and a diff review before pushing. Reusable from assignment-set: src/lib/json-body.ts (the parsed-body guard every bearer op needs before reading .op) and the db-free input-validator pattern in src/lib/assignment-set-input.ts, which exists because server-only blocks vitest from any module importing @/lib/db.