feat(profile): role claim in the profile ticket

The public profile ticket now carries the user's role so Core can check
ownership of shop items. PLATFORM_ADMIN gets every catalog item for free.
The role comes from the users table; a ticket without the claim means USER.

readme.md

@@ -39,8 +39,9 @@ To Be Played is split into three repositories:
   10 minutes, `typ=public-profile`) that Core accepts for the public library data only. The profile has its own
   look (accent, corners, banner and background from own game art) and a **tile layout** (`profile_tiles`: the shown
   tiles in order, each with a size S, M or L), apart from the app appearance; the public answer sends both as
-  `style`. The ticket's claims come from the layout: `sections` names the shown parts (`STATS` when any `STATS_`
-  tile is shown), `profileStats` the stat groups of the `STATS_` tiles. The user's dashboard layout
+  `style`. The ticket also names the user's `role`, so Core can show the free looks of an admin. The ticket's
+  claims come from the layout: `sections` names the shown parts (`STATS` when any `STATS_` tile is shown),
+  `profileStats` the stat groups of the `STATS_` tiles. The user's dashboard layout
   (`dashboard_tiles`, NULL = never changed) is stored the same way. The ticket is not a login: every token names
   its kind in `aud` (`tbp-login`, `tbp-public-profile`, `tbp-internal`, `iss=tbp-auth`), and both services check it.
   A login's `sub` is the user id; the email is in no token. A token without `aud` is refused. The claims are pinned in