Low test coverage on security/business-critical modules (roles.ts, provisioning.ts, team/store.ts)

Imported from GitHub issue El-SaMa/oma#112 by @El-SaMa.

`apps/web/lib/` sits at ~7.8% test coverage, `services/core-api/src/` at ~19.6%. Notably untested: `lib/roles.ts` (the exact file containing today's platform-wide-admin-access bug, issue #94), `lib/enhance/provisioning.ts` (29KB, core order/checkout/provisioning logic), `lib/team/store.ts` (team invitation/permission logic), `services/core-api/src/billing.ts`.

Fix: prioritize tests for `roles.ts`/`resolveRoleForUser` first (would have caught #94 directly), then provisioning.ts and team/store.ts. Not asking for blanket coverage — these three are the ones where a silent bug has direct security/billing consequences.