feat(roles): roles remember the jobs they follow (re-appliable), every role edit is signed

Closes the permissions-matrix loose ends (venue-modules.md §Permissions matrix):

- `role_jobs` (migration 0029): a role stores the manifest jobs it was composed from
  (chips on at save + any bundle fully present). `jobById` / `jobsBehind` in
  @parking/shared surface a followed job whose bundle grew past the role in a later
  release; the roles list shows a "behind <job>" badge with a one-click "Update to job"
  (the union, nothing removed) and the editor lints it. Never a runtime union: the grid
  stays the explicit enforcement layer and an update never widens a role without a click.
- Every role create/update/delete appends a `config_change` (`role.<id>`, prev/value =
  name + sorted permissions + jobs, operator); a no-op resave signs nothing. roleRoutes
  now takes the ledger.
- booth-supervisor already carries subscription:*; the stale open note is closed.

Tests: routes/roles.test.ts. Wiki: venue-modules status, local-jwt-auth, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

packages/db/drizzle/0029_role_jobs.sql

@@ -0,0 +1,10 @@
+-- Roles remember the manifest JOBS they were composed from (venue-modules.md §"Permissions
+-- matrix", move 2) so a role built from a job chip can be flagged and re-applied when a
+-- later release grows that job's bundle. The permission grid stays the enforcement layer.
+CREATE TABLE `role_jobs` (
+	`role_id` text NOT NULL,
+	`job_id` text NOT NULL,
+	FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `role_jobs_role_id_job_id_unique` ON `role_jobs` (`role_id`,`job_id`);

packages/db/drizzle/meta/_journal.json

@@ -204,6 +204,13 @@
       "when": 1788605000000,
       "tag": "0028_carwash_config",
       "breakpoints": true
+    },
+    {
+      "idx": 29,
+      "version": "6",
+      "when": 1788690000000,
+      "tag": "0029_role_jobs",
+      "breakpoints": true
     }
   ]
 }