feat(F-006): users profile, addresses and RBAC

- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green

backlog/features.json

@@ -237,12 +237,12 @@
         "Address CRUD works end to end for own addresses",
         "verify.sh green"
       ],
-      "status": "pending",
+      "status": "done",
       "created_at": "2026-08-14",
       "gates": {
-        "review": false,
-        "security": false,
-        "qa": false
+        "review": true,
+        "security": true,
+        "qa": true
       }
     },
     {