fix(api): drop session.Role after base removed the field

Session no longer carries Role (removed upstream when the auth model
moved to group-based permissions via HasPermissionAPI). Remove the
stale session.Role reference from principalFromBearerToken and drop
the corresponding test assertion that expected a role value the session
mock never set.

Closes the go vet compile error blocking pre-commit on PR #864.

Author: cristim

internal/api/middleware.go

@@ -163,7 +163,6 @@ func (h *Handler) principalFromBearerToken(ctx context.Context, req *events.Lamb
 		Kind:    PrincipalSession,
 		UserID:  session.UserID,
 		Email:   session.Email,
-		Role:    session.Role,
 		Session: session,
 	}
 }

internal/api/router_authuser_test.go

@@ -131,7 +131,6 @@ func TestRequireAuth_UserSession(t *testing.T) {
 	require.NotNil(t, p)
 	assert.Equal(t, PrincipalSession, p.Kind)
 	assert.Equal(t, "uid", p.UserID)
-	assert.Equal(t, "user", p.Role)
 	assert.Equal(t, userSession, p.Session)
 }