User roles

There are now three roles:

```rb
Role.everyone
Role.full_hacker_schooler
Role.admin
```

Every user has the `everyone` role, Hacker Schoolers whose batch has started additionally have the `full_hacker_schooler` role, and faculty have every role.

Subforums have `required_role_ids`, and a user can only see that subforum (and the containing threads/posts) if they have the required roles.
`Role.admitted` no longer exists. This migration will fail.