docs: sync from backend 8b8c1ae / frontend 583d55a — guard role + Mini App tab fix (v2.8.54)

09 - Audits/Activity Log.md

@@ -566,4 +566,25 @@ the buyer/seller room.
 
 ---
 
+### 2026-06-03 — backend@8b8c1ae, frontend@583d55a — 'guard' role + Mini App tab fix (v2.8.54)
+
+**Commits:** `8b8c1ae` (backend), `583d55a` (frontend)
+**Touched (backend):** User model, drizzle users schema + migration `0017_user_role_guard.sql`,
+postgresAuthSchema (enum + ALTER TYPE for existing DBs), shared types, IUserRepo,
+authStore/authService role types, userRoutes role validation
+**Touched (frontend):** role types/permissions/display-names, user forms, useRole hook,
+_roles mock, user-table-row (central role labels), telegram-mini-app-view (tab dispatch)
+**Why:**
+1. New admin-assignable role «نگهبان» (guard), registered across every role definition site —
+   modeled on resolver. No special endpoint permissions yet; grant via authorizeRoles() later.
+   Side fix: the admin role-change endpoint previously rejected 'resolver' (validation list only
+   had buyer/seller/admin) — both resolver and guard now pass.
+2. Mini App: tapping a bottom tab while a request-detail/chat/new-request overlay was open did
+   nothing (overlay kept rendering over the new tab). Tab selection now dismisses overlays.
+**Verification:** Backend tsc clean, 12 tests green. Frontend tsc + eslint clean. Admin verifies
+after deploy: role dropdown shows نگهبان; Mini App tabs always respond.
+**Linked docs updated:** `03 - API Reference/User API.md` (role enum), pending.
+
+---
+
 <!-- Add new entries above this line. Newest at top. -->