feat(roles): add dedicated Supervisor (capoturno) role

Until now the out-of-tolerance authorization ("Autorizzazione capoturno")
required is_admin, conflating shift-leader authority with full system
administration. Introduce a combinable Supervisor role so a capoturno can
authorize overrides without admin privileges (roadmap D-0.8 / Phase 2).

Backend:
- users router: add "Supervisor" to the allowed roles (centralized as
  VALID_ROLES, deduplicating the create/update validation).
- middleware: add require_supervisor dependency (admins still bypass).

Frontend:
- measure.validate_supervisor: authorize users with the Supervisor role OR
  is_admin (was is_admin only).
- admin/users: Supervisor checkbox + orange role badge.
- profile: explicit Supervisor badge styling.
- EN translation for the new role label.

roles is a free JSON column, so no migration is required.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/frontend/flask_app/blueprints/measure.py

@@ -347,7 +347,8 @@ def validate_supervisor():
         return jsonify({"error": True, "detail": "Credenziali non valide"}), 401
 
     user = resp.get("user", {})
-    if not user.get("is_admin"):
+    is_supervisor = "Supervisor" in (user.get("roles") or [])
+    if not (is_supervisor or user.get("is_admin")):
         return jsonify({"error": True, "detail": "Utente non autorizzato (richiesto capoturno)"}), 403
 
     return jsonify({"authorized": True, "supervisor": user.get("display_name", username)}), 200