feat(auth): add contexts + platform.is_super_admin to /auth/me, factory role-category states

Additive enrichment to MeResource — existing fields untouched, MeTest stays green.
New fields:
- contexts.available: list<'portal'|'organizer'> derived from Person + Organisation memberships
- contexts.default: precedence super_admin > organizer > portal > fallback portal
- platform.is_super_admin: bool promoted from app_roles
- organisations[].roles: 1-element array form alongside the legacy scalar role,
  forward-compatible for the multi-role pivot work tracked in TECH-PIVOT-ROLES-MULTI

UserFactory gains volunteer(), orgAdmin(), volunteerAndOrganizer(), superAdmin()
state methods — codified role categories for reuse across future workstreams.

Adds forbidden.vue placeholder (PublicLayout) for the context-failure landing in
the upcoming guard rewrite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/app/src/pages/forbidden.vue

@@ -0,0 +1,23 @@
+<script setup lang="ts">
+definePage({
+  name: 'forbidden',
+  meta: { layout: 'PublicLayout', public: true },
+})
+</script>
+
+<template>
+  <div class="d-flex flex-column align-center justify-center pa-12">
+    <h1 class="text-h3 mb-4">
+      Geen toegang
+    </h1>
+    <p class="text-body-1 mb-6">
+      Je hebt geen toegang tot deze pagina.
+    </p>
+    <VBtn
+      :to="{ name: 'login' }"
+      color="primary"
+    >
+      Naar inloggen
+    </VBtn>
+  </div>
+</template>