[tire-fire]

The authentication middleware stores the caller three times on the request context: as an Identity (typed key), and again under the plain string keys "username" and "roles". Its comment says the string keys should go once every handler reads Identity. This finishes that.

• Adds CallerRoles(ctx), which returns the caller's roles, or nil for an anonymous request.
• Every reader of Value("roles") / Value("username") (announcements, api, authentication, graphs, identity, injects, pcrs, services, frontend, logging middleware) now uses CallerRoles or IdentityFrom.
• The middleware stores only the Identity. The two nolint:staticcheck comments for string context keys go with it.

Behavior is unchanged with one exception: handlers that did a bare Value("roles").([]string) would panic if reached without an identity, and now see no roles instead.

pageData still leaves username unset for anonymous requests. page.html checks {{ if ne .username nil }}, and an empty string there would render the page as logged in.

Tests: added TestCallerRoles. The test helper requestAs now sets roles on the Identity, as the middleware does. Unit tests pass with -race, and golangci-lint is clean.