RBAC in MERN — Stop Hardcoding Role Checks

You have JWT authentication working. Login works, protected routes work, req.user is populated on every request. Then the next requirement comes in. Admins need to delete users. Managers need to appro