Finish the 'viewer' role: surface staff.audit as a grantable, LuckPerms-fed read-only oversight role

Builds on PAR-98 (group+capability RBAC) and the reconciliation cron (PAR-99).

Problem: the financial-oversight capability exists internally as staff.audit but is never surfaced as a first-class, documented, grantable role. It's not in the user-facing roles doc, and there's no clear "viewer" identity for admins to attach to a LuckPerms-fed group.

Change — make viewer the canonical, user-facing financial-oversight role:

• Rename the capability staff.audit → viewer in the explorer vocabulary (lib/auth/capabilities.ts), keeping staff.audit as a recognized legacy alias (normalizeCapability) so existing group rows never silently lose access.
• isStaff now keys off viewer; all existing financial gates (account history, ChestShop firm/item drilldowns, leaderboards) honor it unchanged.
• Capability resolution in getViewer normalizes stored strings (legacy staff.audit → viewer); the admin group editor shows the legacy row as the Viewer checkbox.
• Header shows a viewer badge for a linked player who holds it without higher tier; /me notes the access.
• Recon cron: generic membership sync already distributes any group; verified end-to-end (LuckPerms node → explorer_group_member source='luckperms' → linked player's getViewer caps → isStaff). Added an integration assertion for a LuckPerms-sourced viewer member.
• Flyway V21: data migration renaming existing explorer_group_capability.capability rows staff.audit → viewer.
• Docs: docs/admin/roles.md documents the Viewer role and that it's granted via a (LuckPerms-fed) group, requiring the player to be linked.
• Tests: capabilities/access unit tests + integration seed updated; legacy-alias test added.

Components: economy-explorer (primary), economy-flyway (V21 data migration).