feat: add hotel_admin (Системный администратор) and technician roles + protect hotel owner from deletion

- Migration 035: extend role constraint to include hotel_admin and technician; migrate existing manager users to hotel_admin
- auth.ts: registration now assigns hotel_admin (not manager) to hotel owner
- seed.ts: demo user manager@grand-palace.ru seeded as hotel_admin
- types.ts: expand JwtPayload role union with all roles
- users.ts: hotel_admin included in access checks; role creation/edit/delete rules enforced; hotel_admin users are undeletable and uneditable (non-super_admin); role cannot be set to hotel_admin via PATCH
- rooms.ts / channels.ts: hotel_admin added to write-access checks
- UsersPage.tsx: hotel_admin and technician added to StaffRole, ROLE_META, DEFAULT_POSITIONS, mapRole, backendRoleMap, INITIAL_ROLE_PERMISSIONS; delete button hidden for hotel_admin; role selector locked for hotel_admin users; hotel_admin excluded from new-user role selector

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/seed.ts

@@ -68,7 +68,7 @@ export async function seedIfEmpty() {
   )
   await db.query(
     `INSERT INTO users (email, password_hash, name, role, hotel_id) VALUES
-       ($1, $2, 'Артём Голомазов', 'manager',      $3),
+       ($1, $2, 'Артём Голомазов', 'hotel_admin', $3),
        ($4, $2, 'Клавдия Иванова',  'housekeeper',  $3)`,
     ['manager@grand-palace.ru', passwordHash, gp.id,
      'cleaner@grand-palace.ru'],
@@ -126,6 +126,6 @@ export async function seedIfEmpty() {
 
   console.log('[seed] ✅ Demo data seeded')
   console.log('[seed]    admin@hotelsync.io  / demo  (super_admin)')
-  console.log('[seed]    manager@grand-palace.ru / demo  (manager)')
+  console.log('[seed]    manager@grand-palace.ru / demo  (hotel_admin)')
   console.log('[seed]    cleaner@grand-palace.ru / demo  (housekeeper)')
 }