feat(role): add role_code across schema and APIs

README.md

@@ -75,6 +75,8 @@ curl http://127.0.0.1:8000/healthz
 - `GET /admin/members/{user_sub}/roles`
 - `GET/POST/PATCH/DELETE /admin/api-clients`
 
+> `roles` 現在包含 `role_code` 欄位（建議用於跨系統權限語意解析）；`role_key` 保留為唯一識別鍵。
+
 ### Internal APIs (`X-Client-Key` + `X-API-Key`)
 - `GET /internal/companies`
 - `GET /internal/sites`
@@ -84,3 +86,10 @@ curl http://127.0.0.1:8000/healthz
 - `POST /internal/users/upsert-by-sub`
 - `GET /internal/users/{user_sub}/roles`
 - `POST /internal/provider/users/ensure`
+
+## DB Migration
+
+- 既有 DB 升級（新增 `roles.role_code`）：
+```bash
+psql "$DATABASE_URL" -f scripts/migrate_add_role_code.sql
+```