Add per-role badge colors

Role badges rendered gray for everything except admin, with no way to tell
roles apart. Add an optional color per role, matching how statuses and types
carry one: new roles.color column (migration 7d27_roles_color), color threaded
through the role API and the user serializer, and a ColorSwatchPicker in the
role editor. Badges use the role's color with contrast-aware text and fall
back to the old admin/gray classes when unset.

tests/test_core/test_users_api.py

@@ -27,3 +27,23 @@ def test_delete_user_with_tokens_and_audit_history(client, auth_headers, app, db
         assert ApiToken.query.filter_by(userid=userid).count() == 0
         detached = AuditLog.query.filter_by(entityname='imported thing').one()
         assert detached.userid is None
+
+
+def test_role_color_create_list_update(client, auth_headers):
+    """A role carries an optional badge color through create, list, and update."""
+    created = client.post('/api/users/roles', headers=auth_headers, json={
+        'rolename': 'painters', 'description': 'colorful', 'color': '#ff8800',
+        'permissions': [],
+    })
+    assert created.status_code == 201, created.get_json()
+    roleid = created.get_json()['data']['roleid']
+    assert created.get_json()['data']['color'] == '#ff8800'
+
+    listed = client.get('/api/users/roles', headers=auth_headers)
+    row = next(r for r in listed.get_json()['data'] if r['roleid'] == roleid)
+    assert row['color'] == '#ff8800'
+
+    updated = client.put(f'/api/users/roles/{roleid}', headers=auth_headers,
+                         json={'color': '#00aa55'})
+    assert updated.status_code == 200, updated.get_json()
+    assert updated.get_json()['data']['color'] == '#00aa55'