Role-based access with one reusable middleware (and a frontend guard to match)

Role checks have a way of rotting. It starts innocently — an if ($user->role !== 'admin') in one controller. Then it's in five controllers, then someone adds a moderator role and you're grepping the c