UserForm was setting role_id on the users table but not syncing to the
role_user pivot table. Permission checks use the pivot (roles() relation),
so users appeared to have the correct role in the UI but had zero
permissions in practice.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>