feat(rbac): add roles and permissions

backend/hermes/app/repositories/user_repository.py

@@ -1,7 +1,8 @@
 from sqlalchemy import select
-from sqlalchemy.orm import Session
+from sqlalchemy.orm import Session, joinedload, selectinload
 
 from app.core.security import hash_password
+from app.models.rbac import Role
 from app.models.user import User
 from app.schemas.user import UserCreate, UserPasswordUpdate, UserUpdate
 
@@ -9,15 +10,31 @@ from app.schemas.user import UserCreate, UserPasswordUpdate, UserUpdate
 class UserRepository:
     @staticmethod
     def get_all(db: Session) -> list[User]:
-        return list(db.scalars(select(User).order_by(User.created_at.desc())))
+        return list(
+            db.scalars(
+                select(User)
+                .options(
+                    joinedload(User.primary_role).selectinload(Role.permissions),
+                )
+                .order_by(User.created_at.desc())
+            )
+        )
 
     @staticmethod
     def get_by_id(db: Session, user_id: int) -> User | None:
-        return db.get(User, user_id)
+        return db.scalar(
+            select(User)
+            .where(User.id == user_id)
+            .options(joinedload(User.primary_role).selectinload(Role.permissions))
+        )
 
     @staticmethod
     def get_by_username(db: Session, username: str) -> User | None:
-        return db.scalar(select(User).where(User.username == username))
+        return db.scalar(
+            select(User)
+            .where(User.username == username)
+            .options(joinedload(User.primary_role).selectinload(Role.permissions))
+        )
 
     @staticmethod
     def find_conflict(
@@ -52,6 +69,7 @@ class UserRepository:
             username=user.username,
             email=str(user.email),
             role=user.role,
+            role_id=user.role_id,
             is_active=user.is_active,
             password_hash=hash_password(user.password),
         )
@@ -60,7 +78,7 @@ class UserRepository:
         db.commit()
         db.refresh(db_user)
 
-        return db_user
+        return UserRepository.get_by_id(db, db_user.id) or db_user
 
     @staticmethod
     def update(db: Session, db_user: User, user: UserUpdate) -> User:
@@ -69,6 +87,8 @@ class UserRepository:
         db_user.username = user.username
         db_user.email = str(user.email)
         db_user.role = user.role
+        if user.role_id is not None:
+            db_user.role_id = user.role_id
         db_user.is_active = user.is_active
 
         if user.password:
@@ -77,7 +97,7 @@ class UserRepository:
         db.commit()
         db.refresh(db_user)
 
-        return db_user
+        return UserRepository.get_by_id(db, db_user.id) or db_user
 
     @staticmethod
     def update_password(