fix(auth): default role assignment to APPROVED at signup

Roles assigned at registration are immediately active for login + session.
Document/profile approval (handled separately by user_role_profiles in
onboarding/verifications) is the correct gate for review workflows —
do not gate raw role assignment on that flow.

Previously defaulted to PENDING for non-demo accounts, which get filtered
out by get_user_role_keys (WHERE status = 'APPROVED') and produced JWTs
with empty roles, causing the 'role is not assigned' UX bug after login.

apps/users/src/handlers/auth.rs

@@ -330,14 +330,19 @@ async fn register(
     for role_key in role_candidates {
         let role_id = ensure_role_exists(&state.pool, &role_key).await;
         if let Some(role_id) = role_id {
-            // For demo accounts, auto-approve the role immediately
-            let status = if is_demo_account { "APPROVED" } else { "PENDING" };
-            
+            // Roles assigned at signup are immediately ACTIVE for login + session.
+            // Document/profile review (handled separately in onboarding / verifications)
+            // still uses PENDING_APPROVAL via user_role_profiles — do NOT gate raw
+            // role assignment on that flow. Previously this defaulted to "PENDING"
+            // which made get_user_role_keys return [] and login issued a JWT with
+            // no role, breaking the "role not assigned" UX bug.
+            let status = "APPROVED";
+
             // Try to update existing assignment first
             let update_result = sqlx::query(
                 r#"
                 UPDATE user_role_assignments
-                SET status = $3
+                SET status = $3, approved_at = NOW()
                 WHERE user_id = $1 AND role_id = $2
                 "#,
             )