Update web UI to support all compile-time roles

- Update knownRoles to include guest, viewer, editor, and commenter
- Replace hardcoded role strings with model constants
- Remove obsolete 'service' role from UI
- All tests pass

internal/ui/handlers_accounts.go

@@ -15,7 +15,14 @@ import (
 )
 
 // knownRoles lists the built-in roles shown as checkboxes in the roles editor.
-var knownRoles = []string{"admin", "user", "service"}
+var knownRoles = []string{
+	model.RoleAdmin,
+	model.RoleUser,
+	model.RoleGuest,
+	model.RoleViewer,
+	model.RoleEditor,
+	model.RoleCommenter,
+}
 
 // handleAccountsList renders the accounts list page.
 func (u *UIServer) handleAccountsList(w http.ResponseWriter, r *http.Request) {