Extra roles in the Rac User Panel
Membership roles (owner/admin/member/viewer) are on Employees. Customer-safe IAM extra roles and groups are managed in the Rac User Panel — no local ForteUnit role engine.
IAM catalog roles/groups: existing customer API `/api/v1/auth/tenant/*` in the Rac User Panel. ForteUnit does not duplicate that editor.