Minimal RBAC + Feature Flags + Developer Mode

- 4 roles: SuperAdmin, Operator, Reviewer, PilotUser
- Capabilities (not pages): mission.create, artifact.view, decision.approve, etc.
- Feature flags: ENABLE_REPLAY, ENABLE_MODEL_TRAINING, etc.
- Developer Mode toggle in UI (activated by permission)
- New rule: All features must link to module, capability, and role

Next: Deploy pilot environment

packages/domain/src/auth/feature-flags.ts

@@ -0,0 +1,50 @@
+/**
+ * Feature Flags — enable features without new releases
+ *
+ * Pilot 001-010: Control which modules are visible.
+ */
+
+export type FeatureFlag =
+  | 'ENABLE_REPLAY'
+  | 'ENABLE_DATASET_EXPLORER'
+  | 'ENABLE_MODEL_TRAINING'
+  | 'ENABLE_HOTSPOTS'
+  | 'ENABLE_ECONOMIC_ENGINE'
+  | 'ENABLE_DEVELOPER_MODE';
+
+export interface FeatureFlags {
+  readonly flags: Record<FeatureFlag, boolean>;
+}
+
+export const DefaultFeatureFlags: FeatureFlags = {
+  flags: {
+    ENABLE_REPLAY: false,
+    ENABLE_DATASET_EXPLORER: true,
+    ENABLE_MODEL_TRAINING: false,
+    ENABLE_HOTSPOTS: false,
+    ENABLE_ECONOMIC_ENGINE: false,
+    ENABLE_DEVELOPER_MODE: false,
+  },
+};
+
+export function isEnabled(flags: FeatureFlags, flag: FeatureFlag): boolean {
+  return flags.flags[flag] ?? false;
+}
+
+export function enable(flags: FeatureFlags, flag: FeatureFlag): FeatureFlags {
+  return {
+    flags: {
+      ...flags.flags,
+      [flag]: true,
+    },
+  };
+}
+
+export function disable(flags: FeatureFlags, flag: FeatureFlag): FeatureFlags {
+  return {
+    flags: {
+      ...flags.flags,
+      [flag]: false,
+    },
+  };
+}