Add docs/reference/roles-and-access.md — a short, scannable reference for the three dev roles (drafter/approver/admin), that login is faked and role is a separate dev-only stand-in, how to switch (dev switcher / ?role=), a per-role capability table, and the one ABAC principle (server emits + enforces; UI renders). Points to PRD-0002 + the code. Adds a pointer from CLAUDE.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>