fix: role and user command revamp for cloud

[pratik50]

Description

This PR improves user and role management:

• Cloud user creation now tell's users to invite through dashboard.
• Self-hosted user creation requires a role and lists available role names.
• user set-role appends roles without removing existing roles.
• Missing users receive clear create/invite instructions.
• role add now only asks for a privilege.
• Removed dataset and tag prompts from role creation.
• role rm checks the role name exists before deleting.

Documentation updates needed

Please update the CLI docs for:

pb user add <user> --role <role>
pb user set-role <user> <role>
pb role add <role>
pb role remove/rm <role>

Mention that Cloud users must be invited through the dashboard.

Summary by CodeRabbit

• New Features
  • Added support for roles using separate dataset and tag values (with legacy stream compatibility).
  • Updated user role commands to properly add roles via the role-add endpoint.
  • Improved role-selection UI to focus on choosing a role and submitting.
• Bug Fixes
  • Strengthened role validation to require exact role matches (no partial-name behavior).
  • Updated missing-role messaging and deterministic sorting for clearer guidance.
• Documentation
  • Documented user and role behavior for role add/remove and user role assignment.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 33edcc38-bdeb-49bd-a0cc-081e1f54c60d

📥 Commits

Reviewing files that changed from the base of the PR and between 3e48b5c and 804ce1d.

📒 Files selected for processing (3)

• README.md
• cmd/role.go
• cmd/user.go

🚧 Files skipped from review as they are similar to previous changes (2)

• cmd/user.go
• cmd/role.go

---

📝 Walkthrough

Walkthrough

Role handling now distinguishes dataset and tag fields, uses exact role membership checks, updates user role assignment requests, adds cloud-specific guidance, and simplifies the role-selection interface by removing stream and tag inputs.

Changes

Role workflows

Layer / File(s)	Summary
Dataset-aware role resources and commands cmd/role.go, README.md	Role resources render dataset and tag values, role creation builds dataset-aware payloads, existence checks use exact membership, and list output uses a DATASET column with legacy stream fallback. Documentation describes the updated user and role behavior.
User creation and role assignment cmd/user.go	Cloud profiles are blocked from user creation, role inputs are trimmed and validated exactly, guidance messages are profile-specific, and role assignment uses a PATCH request to the role-add endpoint.
Simplified role selection UI pkg/model/role/role.go	The role model removes stream and tag inputs and simplifies focus, navigation, update handling, and rendering to role selection plus submission.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant UserCommand
  participant RoleAPI
  participant UserAPI
  User->>UserCommand: add or assign roles
  UserCommand->>RoleAPI: fetch available roles
  RoleAPI-->>UserCommand: role names
  UserCommand->>UserAPI: PATCH user/{name}/role/add
  UserAPI-->>UserCommand: role assignment response

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately describes the main user and role command revamp, including cloud-related behavior.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/user.go`:
- Around line 75-79: Update the CLI documentation for all affected commands: in
cmd/user.go lines 75-79, state that Cloud users must be invited through the
dashboard; in cmd/user.go lines 202-203, clarify that user set-role adds roles
without removing existing assignments; in cmd/role.go lines 108-114, explain
that role add requests only a privilege; and in cmd/role.go lines 162-170,
document role remove and its rm alias, including guidance for missing roles.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 57fcb3a2-2a8f-40ed-b498-2c71cf07dea2

📥 Commits

Reviewing files that changed from the base of the PR and between 6bfb15c and 3e48b5c.

📒 Files selected for processing (3)

• cmd/role.go
• cmd/user.go
• pkg/model/role/role.go