0.2.45: Administrator (view only) role

New external role administrator_viewer: signs into the admin interface
and reads everything for its granted funds and SPVs (overview, partners,
capital accounts with every investor's statements, documents, valuation
history) but every write is refused: no imports, uploads, deletions,
entity edits, exit marking, or account management. No migration needed;
roles are stored as strings.

Internal admins can flip an Administrator between full management and
view only via a new Access level dropdown in Users > Manage. The
user-list endpoint is read-widened for the viewer role so investor names
resolve on its screens; all mutating endpoints keep the stricter gate.

backend/ten31portal/routers/user_router.py

@@ -6,7 +6,7 @@ from sqlmodel import Session, select, col
 from ten31portal.audit import record_audit
 from ten31portal.auth import (
     accessible_entity_ids, can_access_entity, check_administrator_scope, get_current_user,
-    hash_password, household_user_ids, require_admin, require_internal_admin,
+    hash_password, household_user_ids, require_admin, require_internal_admin, require_role,
 )
 from ten31portal.database import get_session
 from ten31portal.models import (
@@ -329,7 +329,13 @@ def _set_entity_access(user_id: int, entity_ids: list[int], session: Session) ->
 
 @router.get("")
 def list_users(
-    admin: User = Depends(require_admin),
+    # Read-widened: a view-only Administrator may list the investors of its funds (it needs
+    # their names on the capital-accounts and documents screens); every mutating endpoint
+    # below keeps the stricter require_admin gate.
+    admin: User = Depends(require_role(
+        UserRole.approver, UserRole.cfo, UserRole.operations,
+        UserRole.fund_administrator, UserRole.administrator_viewer,
+    )),
     session: Session = Depends(get_session),
 ) -> list[UserResponse]:
     rows = session.exec(select(User).order_by(User.name)).all()  # type: ignore[arg-type]