feat(interests): manual stage override + Residential Partner system role

Manual stage override
  Sales reps need to skip canTransitionStage rules when the data was
  entered out of order — e.g. recording a contract_signed deal whose
  earlier stages were never tracked in the system.

  - New permission flag interests.override_stage in RolePermissions.
    Plumbed through the schema TS type, the role-editor UI, the seed
    file's pre-built roles (super_admin/director/sales_manager get it,
    sales_agent + viewer don't), and the test factories.
  - changeStageSchema gains an optional `override` boolean and the
    service checks it before evaluating canTransitionStage. When
    override=true the reason field becomes required (min 5 chars) and
    is recorded in the audit log.
  - The route handler gates `override` on the new permission so a
    sales_agent without it can't pass override=true and bypass.
  - InterestStagePicker auto-detects when the requested transition is
    blocked by the table and switches into "override mode" — shows an
    amber warning, requires the reason, button label flips to
    "Override stage". When the operator lacks the permission, the
    warning is red and the button is disabled.

Residential Partner role
  Per the smart-archive scoping conversation: external partners who
  handle residential inquiries shouldn't see marina clients, yachts,
  berths, or financials. The two residential_* permission groups
  already exist; this commit just seeds a pre-built system role
  ("residential_partner") with those flags + minimal own-reminders, so
  admins can invite a partner today via /admin/users without manually
  building the permission set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/interests.service.ts

@@ -611,9 +611,17 @@ export async function changeInterestStage(
   // Block egregious skips. The transition table allows reasonable forward
   // jumps (e.g. open → eoi_sent) while rejecting things like completed → open
   // or open → contract_signed. Same-stage no-ops are allowed.
-  if (!canTransitionStage(existing.pipelineStage, data.pipelineStage)) {
+  // Override (sales-rep manual fix) bypasses the table — the route handler
+  // gates this on the `interests.override_stage` permission and requires
+  // a reason, recorded in the audit log below.
+  if (!data.override && !canTransitionStage(existing.pipelineStage, data.pipelineStage)) {
     throw new ValidationError(
-      `Cannot move interest from "${existing.pipelineStage}" directly to "${data.pipelineStage}".`,
+      `Cannot move interest from "${existing.pipelineStage}" directly to "${data.pipelineStage}". Use the override option if you need to skip stages — requires a reason.`,
+    );
+  }
+  if (data.override && (!data.reason || data.reason.trim().length < 5)) {
+    throw new ValidationError(
+      'Override requires a reason (min 5 chars) explaining the manual stage change.',
     );
   }