feat(auth.service): add role to token payload and hasRole check for route middleware