officer.dev: account creation exists, and roles are a table

This file said there was no way to create a second account. There is, and has
been since 69a31051 — POST /api/users, owner-gated, with a form under Settings.
platform/CLAUDE.md and docs/roles-and-teams.md carried the same stale claim and
were corrected in the platform repo; this one was missed because I said it was
not in a git repository. It is, through the symlink.

Also records roles as a table with foreign keys onto roles.name, USER_ROLES
gone, and UserRole as a plain string guarded at the write path instead of by the
compiler.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

officer.dev/CLAUDE.md

@@ -175,10 +175,17 @@ keyed on **role**, never on a user, and live in `role_capabilities`; absence den
 capabilities (terminal, chat, files, tasks, items, desktop, browser) run as the owner's OS user in the
 owner's home and are **never grantable at any level** — that is structural, not a policy default.
 
-What is NOT built: **there is no way to create a second account.** `createUser` has one call site,
-`api/auth/bootstrap.ts`, gated on an empty `users` table. No signup route, no invites, no admin
-create-user handler — the six accounts in Postgres were inserted by hand. Details and the open defect
-list are in `platform/TODO.md` → "Multi-user"; the design write-up is `COMMS/capability-permissions-2026-08-07.md`.
+**Account creation now exists** — `POST /api/users`, owner-gated, with a form under Settings → User
+Management, plus role change, password reset, Linux provisioning and delete. It landed in `69a31051`; this
+file claimed the opposite for days afterwards, and so did `platform/CLAUDE.md` and
+`docs/roles-and-teams.md`, which sequenced a phase around building the thing that already existed.
+
+Roles are a table as of 2026-08-23, with `users.role` and `role_permissions.role` as foreign keys onto
+`roles.name` with `ON UPDATE CASCADE`. `USER_ROLES` is gone and `UserRole` is `string`, so the guard the
+compiler used to provide is now a runtime check at every write path that takes a role from outside.
+
+The design write-up is `COMMS/capability-permissions-2026-08-07.md`; the roles plan and what is still open
+is `docs/roles-and-teams.md`.
 
 The single-user claims that used to be all over this repo's docs were corrected on 2026-08-07. If you
 find another one, it is stale — `platform/src/servers/capabilities/registry.ts` is the authority.