feat(l1): add L1 columns + extend account_role CHECK constraint

Adds users.can_cover_l1, accounts.l1_seats_purchased, subscriptions.l1_seat_limit,
audit_logs.acting_as. Rotates the users.account_role CHECK constraint to include
'l1_tech' (was: 'owner', 'admin', 'engineer', 'viewer').

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/app/models/user.py

@@ -1,7 +1,7 @@
 import uuid
 from datetime import datetime, timezone
 from typing import Optional, TYPE_CHECKING
-from sqlalchemy import String, DateTime, ForeignKey, Boolean, CheckConstraint, Text, Integer
+from sqlalchemy import String, DateTime, ForeignKey, Boolean, CheckConstraint, Text, Integer, text
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from sqlalchemy.dialects.postgresql import UUID
 from app.core.database import Base
@@ -22,7 +22,7 @@ class User(Base):
             name='ck_users_role_enum'
         ),
         CheckConstraint(
-            "account_role IN ('owner', 'admin', 'engineer', 'viewer')",
+            "account_role IN ('owner', 'admin', 'engineer', 'l1_tech', 'viewer')",
             name='ck_users_account_role_enum'
         ),
     )
@@ -50,6 +50,9 @@ class User(Base):
         index=True
     )
     account_role: Mapped[str] = mapped_column(String(50), nullable=False, default="engineer")
+    can_cover_l1: Mapped[bool] = mapped_column(
+        Boolean(), nullable=False, server_default=text('false')
+    )
 
     # Legacy team columns (kept for PR A coexistence)
     team_id: Mapped[Optional[uuid.UUID]] = mapped_column(