feat(F-006): users profile, addresses and RBAC

- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green

work/artifacts/F-006/leader-close.json

@@ -0,0 +1,33 @@
+{
+  "feature_id": "F-006",
+  "agent": "leader",
+  "stage": "close",
+  "verdict": "APPROVED",
+  "title": "Users: profile, addresses, RBAC",
+  "gates": {
+    "review": "APPROVED",
+    "security": "APPROVED",
+    "qa": "APPROVED"
+  },
+  "verification": {
+    "lint": "clean",
+    "boundaries": "52 files OK",
+    "typecheck": "clean",
+    "build": "clean",
+    "unit_tests": "52 passed, 22 skipped",
+    "integration_tests": "22 passed (PostgreSQL 16)",
+    "verify_sh": "green"
+  },
+  "deliverables": [
+    "migrations/003_identity_roles.js, migrations/004_users.js",
+    "src/shared/auth.ts (Role, CurrentUser, Authenticate, requireRole, requireOwnerOrAdmin)",
+    "src/modules/users/ (domain, application, infrastructure, api)",
+    "identity: session-authenticator + role in model/responses",
+    "app/build-app.ts: cookie plugin at root, Authenticate injection into users",
+    "tests: shared/tests/auth.test.ts, app/tests/users.itest.ts, migrations.itest.ts updated"
+  ],
+  "known_followups": [
+    "GET /users lists only users with a profile row; an admin user-listing endpoint may need an identity-owned port later",
+    "Role promotion is out-of-band DB operation until an admin API exists"
+  ]
+}