🔐 Granular Financial Access & Permission Controls

Consolidated admin roles paired with explicit permission toggles for payment processing, ledger access, and finance reports, plus a standalone Accountant role that restricts access to non-financial student data.