Fix broken RBAC foundation: User.Role + role field mismatch

[RonaldRonnie]

The code/tests reference User.Role.* and a role attribute, butapps/core/models.pydefines only user_type and no Role enum / role field. This will break permissions and appointments RBAC.

Where seen:

• apps/appointments/views.py, apps/appointments/tests/test_appointments_api.py, apps/core/models.py

Acceptance criteria

• User model exposes a single, consistent role concept used everywhere (either add role + Role enum or refactor to use user_type consistently).
• All references to User.Role.* work (or are removed) and tests align.
• Migrations included + existing endpoints still function.