Add accountant role and financial_exported audit event

- New 'accountant' role in companyRoleEnum (orthogonal like 'hr')
- meetsMinRole and requireCompanyRole now exclude accountant from
  hierarchy along with hr
- Settings UI exposes accountant in the role checkbox lists for both
  add-member and edit-member forms
- New 'financial_exported' value added to companyLogEventEnum, ready
  for the upcoming export feature

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/server/authorization.ts

@@ -38,12 +38,15 @@ export function hasRole(roles: CompanyRole[], target: CompanyRole): boolean {
 	return roles.includes(target);
 }
 
-/** Does any hierarchical role in the set meet or exceed the minimum rank? `hr` does not count. */
-export function meetsMinRole(roles: CompanyRole[], min: Exclude<CompanyRole, 'hr'>): boolean {
+/** Does any hierarchical role in the set meet or exceed the minimum rank? `hr` and `accountant` do not count. */
+export function meetsMinRole(
+	roles: CompanyRole[],
+	min: Exclude<CompanyRole, 'hr' | 'accountant'>
+): boolean {
 	const minRank = ROLE_HIERARCHY[min];
 	for (const r of roles) {
-		if (r === 'hr') continue;
-		const rank = ROLE_HIERARCHY[r as Exclude<CompanyRole, 'hr'>];
+		if (r === 'hr' || r === 'accountant') continue;
+		const rank = ROLE_HIERARCHY[r as Exclude<CompanyRole, 'hr' | 'accountant'>];
 		if (rank >= minRank) return true;
 	}
 	return false;
@@ -56,7 +59,7 @@ export function meetsMinRole(roles: CompanyRole[], min: Exclude<CompanyRole, 'hr
 export async function requireCompanyRole(
 	locals: App.Locals,
 	companyId: string,
-	minRole: Exclude<CompanyRole, 'hr'>
+	minRole: Exclude<CompanyRole, 'hr' | 'accountant'>
 ): Promise<{ user: NonNullable<App.Locals['user']>; roles: CompanyRole[] }> {
 	const user = requireAuth(locals);