feat(F-006): users profile, addresses and RBAC

- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green

project/src/modules/users/domain/profile.ts

@@ -0,0 +1,17 @@
+/**
+ * Users domain. Pure types: no framework, no infrastructure.
+ */
+
+export interface Profile {
+  userId: string;
+  displayName: string | null;
+  phone: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+/** Fields a profile update may set. Undefined = leave unchanged. */
+export interface ProfilePatch {
+  displayName?: string | null;
+  phone?: string | null;
+}