Restore soft-deleted users with explicit role regrant decision

PM policy 2026-10-06 (thread pmmaster-evolutiva-cc-muwr9q95sfqv-db-pluto-ca): role memberships do NOT survive as live rows when a user is soft-deleted. DB lane owns the users->userRoles soft-delete cascade and 17-row paired repair on parent PLUTO-639; coder-pluto-cc owns restore-flow half. Current reactivateFromSoftDelete and attachRestoredUserIdentity in src/lib/admin-batch.ts (wrapped by admin-actions.ts) revive the user without touching role rows, which would leave a restored user roleless after the cascade. Design and implement an explicit, audited regrant choice on restore rather than silently reviving previously held roles. Class-A: design ping before implementation and audit diff review before push; coordinate contract/transaction order with db-pluto-ca so source fix lands before paired historical repair. Done only when restore requires an explicit role decision, archived old memberships remain evidence, and forced-red tests prove no automatic old-role revival and a deliberate regrant path.