AO3-7468 Preload current_user roles

[y7nieSEl5]

Pull Request Checklist

• Have you read the contributing guidelines?
• Have you read "How to write the perfect pull request"?
• Have you added tests for any changed functionality?
• Have you added the Jira issue number
  as the first thing in your pull request title (e.g. AO3-1234 Fix thing)
• Do you have fewer than 5 pull requests already open? If not, please wait
  until they are reviewed and merged before creating new pull requests.
• I acknowledge that submitting code created or modified with the help of AI is a bannable offense.

Issue

https://otwarchive.atlassian.net/browse/AO3-7468

Purpose

This PR preloads a user's roles when Devise restores current_user from the session. As a result, subsequent has_role? permission checks use the loaded association instead of performing repeated role lookups throughout the request.

It also:

• Uses has_role? for named-role checks in the admin user form.
• Preloads roles when loading users for admin user pages that render the role collection.
• Adds regression coverage for users with roles, users without roles, invalid session salts, and admin user role preloading.

Credit

y7nieSEl5, she/her