fix(SEC-29): Rollen-Trennung Admins/Auditoren, domain_auditor Rolle

- superadmin + domain_admin haben keinen Mail-Zugriff mehr (requireMailAccess)
- Neue Rolle domain_auditor: alle Tenant-Mails, kein Admin-Zugriff
- auditor + user: nur eigene Mails
- ZIP-Export: kein separates Attachment-Entpacken mehr, nur EML
- roleLevel() um domain_auditor (Level 3) erweitert

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/userstore/userstore.go

@@ -12,11 +12,12 @@ import (
 )
 
 const (
-	RoleUser        = "user"
-	RoleAdmin       = "admin"
-	RoleAuditor     = "auditor"
-	RoleDomainAdmin = "domain_admin"
-	RoleSuperAdmin  = "superadmin"
+	RoleUser         = "user"
+	RoleAdmin        = "admin" // legacy, maps to domain_admin
+	RoleAuditor      = "auditor"
+	RoleDomainAdmin  = "domain_admin"
+	RoleDomainAuditor = "domain_auditor"
+	RoleSuperAdmin   = "superadmin"
 
 	bcryptCost = 12
 )