feat(datatables): data table roles in the DB manager and raw apps

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/src/commands/app/raw_apps.ts

@@ -55,6 +55,8 @@ export interface AppFile {
     tables?: string[];
     datatable?: string;
     schema?: string;
+    /** The role the app uses each data table through, by data table name. */
+    roles?: Record<string, string>;
   };
   // Mirrors granular ACLs on the raw_app path. Synced via /acls/* by
   // applyExtraPermsDiff — never through update_app_raw — so a perm-only

cli/src/guidance/skills.gen.ts

@@ -5775,6 +5775,8 @@ data:
   tables:
     - main/users            # Table in public schema
     - main/app_schema:items # Table in specific schema
+  roles:                    # Optional: the role the app uses each datatable through
+    main: analyst
 \`\`\`
 
 **Table reference formats:**
@@ -5782,6 +5784,8 @@ data:
 - \`<datatable>/<table>\` — Specific table in public schema
 - \`<datatable>/<schema>:<table>\` — Table in specific schema
 
+**Roles:** when a datatable is under roles, its queries run as a role, which only reaches what it was granted. \`roles\` records the role the app uses each datatable through; the app's code must pass the same role: \`wmill.datatable('main', { role: 'analyst' })\` in TypeScript, \`wmill.datatable('main', role='analyst')\` in Python. A datatable without an entry is used as its default role.
+
 ## SQL Migrations (sql_to_apply/)
 
 The \`sql_to_apply/\` folder is for creating/modifying database tables during development.