Initial import into Gitea

Management/Security/ClientContext.cs

@@ -16,5 +16,17 @@ public sealed class ClientContext
     public bool IsDevBypass { get; set; }
 
     public bool IsAuthenticated => !string.IsNullOrWhiteSpace(ClientId);
-    public bool IsAdmin => string.Equals(Role, "Admin", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>Full platform access.</summary>
+    /// <summary>Full admin access — SuperAdmin or Admin role.</summary>
+    public bool IsAdmin =>
+        string.Equals(Role, "SuperAdmin", StringComparison.OrdinalIgnoreCase) ||
+        string.Equals(Role, "Admin",      StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>Health monitoring and Tech Client access only.</summary>
+    public bool IsTech =>
+        string.Equals(Role, "Tech", StringComparison.OrdinalIgnoreCase);
+
+    /// <summary>Any authenticated staff member (SuperAdmin, Admin or Tech).</summary>
+    public bool IsStaff => IsAdmin || IsTech;
 }