feat(backoffice): add Smilegate identity administration

docs/design/smilegate-identity-administration/README.md

@@ -0,0 +1,35 @@
+# Smilegate Backoffice Identity Administration
+
+## Goal
+
+Keep `admin` as the backoffice control-plane login.  Provide an administrator-facing
+model for managing Smilegate PoC tool users, groups, roles, and their assignments.
+These users are tool operators (for example a Data & AI TF lead or member), not
+game-service players.
+
+## Scope
+
+* `SG_APP_USER`, `SG_APP_GROUP`, and `SG_APP_ROLE` are the application masters.
+* `SG_USER_ROLE`, `SG_USER_GROUP`, and `SG_GROUP_ROLE` express normalized
+  user/group/role assignments.
+* Every change is recorded in `SG_AUDIT_EVENT` by the backoffice audit service.
+* Existing `/users`, `/groups`, and `/roles` pages use only the `SG_*` identity
+  model.  They must not require the legacy VPD/permission objects to render.
+
+## Seed data
+
+| Type | Code | Purpose |
+| --- | --- | --- |
+| User | `sg-teamlead` | Data & AI TF team lead demo operator |
+| User | `sg-member` | Data & AI TF member demo operator |
+| Group | `DATA_AI_TF` | Smilegate Data & AI TF |
+| Role | `DATA_AI_TEAM_LEAD` | Team lead operational role |
+| Role | `DATA_AI_TEAM_MEMBER` | Team member operational role |
+
+## Acceptance checks
+
+1. An authenticated `admin` can open `/users`, `/groups`, and `/roles`.
+2. The seed users, group, and roles appear; assignments can be added and removed.
+3. Create, activation, role, and group changes are committed atomically and leave
+   an `SG_AUDIT_EVENT` row.
+4. The pages do not call the legacy effective VPD permission matrix.