FAC-112 feat: derive user roles during Moodle sync (#265) (#266)

* FAC-112 feat: derive user roles during Moodle sync

Add Phase 5 to enrollment sync pipeline that derives user roles
from existing enrollment and institutional role data, eliminating
the requirement for users to log in before roles appear.

- Add protected-roles guard to updateRolesFromEnrollments() to
  preserve SUPER_ADMIN and ADMIN roles through derivation
- Add deriveUserRoles() to EnrollmentSyncService with batch-load,
  group-by-user, and always-flush pattern
- Wire Phase 5 after backfillUserScopes() with non-fatal error handling
- Add 10 unit tests for role derivation logic
- Fix pre-existing lint error in questionnaire-types.spec.ts

Closes #264

* chore: add tech-spec for derive-roles-during-sync

Author: y4nder