remove single-active-role constraint — support multi-role per user

userRoles has partial UNIQUE(userId) WHERE deletedAt IS NULL enforcing exactly one active role/user. Blocks stacking roles (e.g. titular+bedelia). Elazar wants multi-role support: drop/rework the index + audit all role-resolution consumers for multi-row assumptions. Class-A DDL, live-prod → db-venus+audit. Deferred per Elazar 2026-07-06 (approver-set widened to {admin,bedelia,titular} as the interim unblock).