feat(F-006): users profile, addresses and RBAC

- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green

work/artifacts/F-006/documenter.md

@@ -0,0 +1,29 @@
+done -> work/artifacts/F-006/documenter.md
+
+# F-006 — Documentation
+
+Agent: documenter
+Stage: document
+Feature: F-006
+
+## Updated
+
+- `project/README.md`:
+  - Authentication table: register/login responses now include `role`.
+  - New section "Users and RBAC (users module)": endpoint table with access
+    rules, 401/403/404 semantics, anti-enumeration note, SQL scoping note,
+    `GET /users` listing semantics, and the injected-`Authenticate` boundary
+    contract.
+  - Layout: `users/` module added to the tree.
+  - HTTP contract: auth codes now include `UNAUTHORIZED` (401) and
+    `FORBIDDEN` (403).
+- Specs `specs/F-006-users-rbac/` (SPEC/DESIGN/TASKS/TESTS) were authored in
+  the design stage and match the delivered implementation, except the
+  documented deviation noted in `work/artifacts/F-006/implementer.md`
+  (ownership unit tests merged into `shared/tests/auth.test.ts`).
+
+## Not needed
+
+- `spec/tech.md`: no new dependencies this ticket.
+- `spec/roadmap.md`: F-006 already listed in Wave 1; no status field tracked
+  there.