feat(server): add Engine RPC user, grant, role methods

[jgpruitt]

Summary

Implements RBAC (Role-Based Access Control) methods for the Engine RPC endpoint (/api/v1/engine/rpc).

Methods Added

User Methods

Method	Description
user.create	Create a new user
user.get	Get user by ID
user.getByName	Get user by name
user.list	List users (optionally filter by canLogin)
user.rename	Rename a user
user.delete	Delete a user

Grant Methods (Tree-based Access Control)

Method	Description
grant.create	Grant tree access to a user
grant.list	List grants (optionally filter by user)
grant.get	Get a specific grant
grant.revoke	Revoke tree access
grant.check	Check if user has access to a tree path for an action

Role Methods (Role Membership)

Method	Description
role.create	Create a role (user with canLogin=false)
role.addMember	Add a member to a role (with cycle detection)
role.removeMember	Remove a member from a role
role.listMembers	List members of a role
role.listForUser	List roles a user belongs to

New Files

• rpc/engine/user.ts - User method handlers
• rpc/engine/grant.ts - Grant method handlers
• rpc/engine/role.ts - Role method handlers

Changes

• rpc/engine/schemas.ts - Added schemas for all new methods
• rpc/engine/schemas.test.ts - Added 25 new schema tests
• rpc/engine/index.ts - Merged new method registries

Testing

• 148 tests passing (25 new schema tests)
• All checks pass (format, lint, typecheck)

Part of

Server implementation chunk 4/9