Function authority_tier 

pub fn authority_tier(
    is_owner: bool,
    cap_manage_users: bool,
    cap_manage_classes: bool,
) -> i32

Derives an authority tier from capability flags. Higher acts on strictly lower.

• 3 = owner (master-password session; never a stored user row)
• 2 = admin (cap_manage_classes)
• 1 = moderator (cap_manage_users only)
• 0 = user (no management capabilities)