Update docs for recent changes

- ARCHITECTURE.md: add gRPC listener, mciasgrpcctl, new roles,
  granular role endpoints, profile page, audit events, policy actions,
  trusted_proxy config, validate package, schema force command
- PROGRESS.md: document role expansion and UI privilege escalation fix
- PROJECT_PLAN.md: align mciasctl subcommands with implementation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

PROGRESS.md

@@ -4,6 +4,39 @@ Source of truth for current development state.
 ---
 All phases complete. **v1.0.0 tagged.** All packages pass `go test ./...`; `golangci-lint run ./...` clean.
 
+### 2026-03-12 — Update web UI and model for all compile-time roles
+
+- `internal/model/model.go`: added `RoleGuest`, `RoleViewer`, `RoleEditor`, and
+  `RoleCommenter` constants; updated `allowedRoles` map and `ValidateRole` error
+  message to include the full set of recognised roles.
+- `internal/ui/`: updated `knownRoles` to include guest, viewer, editor, and
+  commenter; replaced hardcoded role strings with model constants; removed
+  obsolete "service" role from UI dropdowns.
+- All tests pass; build verified.
+
+### 2026-03-12 — Fix UI privilege escalation vulnerability
+
+**internal/ui/ui.go**
+- Added `requireAdminRole` middleware that checks `claims.HasRole("admin")`
+  and returns 403 if absent
+- Updated `admin` and `adminGet` middleware wrappers to include
+  `requireAdminRole` in the chain — previously only `requireCookieAuth`
+  was applied, allowing any authenticated user to access admin endpoints
+- Profile routes correctly use only `requireCookieAuth` (not admin-gated)
+
+**internal/ui/handlers_accounts.go**
+- Removed redundant inline admin check from `handleAdminResetPassword`
+  (now handled by route-level middleware)
+
+**Full audit performed across all three API surfaces:**
+- REST (`internal/server/server.go`): all admin routes use
+  `requireAuth → RequireRole("admin")` — correct
+- gRPC (all service files): every admin RPC calls `requireAdmin(ctx)` as
+  first statement — correct
+- UI: was vulnerable, now fixed with `requireAdminRole` middleware
+
+All tests pass; `go vet ./...` clean.
+
 ### 2026-03-12 — Checkpoint: password change UI enforcement + migration recovery
 
 **internal/ui/handlers_accounts.go**