feat(roles): roles remember the jobs they follow (re-appliable), every role edit is signed

Closes the permissions-matrix loose ends (venue-modules.md §Permissions matrix):

- `role_jobs` (migration 0029): a role stores the manifest jobs it was composed from
  (chips on at save + any bundle fully present). `jobById` / `jobsBehind` in
  @parking/shared surface a followed job whose bundle grew past the role in a later
  release; the roles list shows a "behind <job>" badge with a one-click "Update to job"
  (the union, nothing removed) and the editor lints it. Never a runtime union: the grid
  stays the explicit enforcement layer and an update never widens a role without a click.
- Every role create/update/delete appends a `config_change` (`role.<id>`, prev/value =
  name + sorted permissions + jobs, operator); a no-op resave signs nothing. roleRoutes
  now takes the ledger.
- booth-supervisor already carries subscription:*; the stale open note is closed.

Tests: routes/roles.test.ts. Wiki: venue-modules status, local-jwt-auth, log.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

wiki/log.md

@@ -3070,3 +3070,13 @@ category/service pickers stayed empty. Cause: `GET /api/carwash/settings` was gu
 `site:read` only — the price list is Setup's data AND the desk's working data. Fixed with a
 new `requireAnyPermission(...)` guard (auth.ts): the read opens to `carwash:read` OR
 `site:read`; the write stays `site:update`. Regression test in carwash.test.ts.
+
+## [2026-09-06] ingest | Permissions matrix loose ends: jobs remembered + re-appliable, role edits signed
+Roles now store the jobs they follow (`role_jobs`, migration 0029); `jobsBehind()` in
+`@parking/shared` surfaces a followed job whose bundle grew past the role; the roles list shows a
+"behind <job>" badge + "Update to job" (union, nothing removed) and the editor lints it. Not a
+runtime union by decision (the grid stays explicit; an update never widens a role without a
+click). Every role create/update/delete appends a `config_change` (`role.<id>`, prev/value =
+name + permissions + jobs, operator); a no-op resave signs nothing. The stale "should
+booth-supervisor carry subscription:*" note is closed — it already does. Tests: routes/roles.test.ts.
+Updated [[venue-modules]] §Permissions matrix status, [[local-jwt-auth]].