SHS OPS + ERP — auth and roles built (Prompt 2). See HANDOFF.md for the build specification.