Schema for admin role levels.

• owner/manager share full back-office access (gated per-page; managers are denied a subset).
• agent is a delivery-driver login for its own run sheet only (/admin/deliveries).
• editor writes listings, groups and site content but holds no DATA_KEY, so attendee PII stays undecryptable for them (CONTENT_ADMIN_LEVELS).
• scanner works a door: the scanner pages, the scan API, and check-in (DOOR_ADMIN_LEVELS).