sprint-2.5: RBAC 4 roles + Studio bootable + Flash Console

End-to-end implementation per docs/sprint-2.5-plan.md.

New requirement added by user mid-sprint: 4-role RBAC (Super Admin /
Engineer / Owner / User) with dual-auth for Engineer flashing firmware,
plus a "mini Arduino IDE" inside the Studio.

Tests: pytest 231/231 green (129 Sprint 2 + 102 Sprint 2.5 new).

RBAC core (arautopilot/core/):

- rbac.py: 4 roles, 12 capabilities, immutable capability matrix,
  has() / capabilities_of() / require() / requires_dual_auth() helpers.
  Engineer flashing firmware needs SA approval; everything else is
  single-factor.
- user.py: User model with PBKDF2-HMAC-SHA256 PIN hashing (200k iters,
  16-byte salt, self-describing hash format for future migrations).
  4-8 digit numeric PINs enforced.
- user_store.py: JSON-backed user database. seed_demo_users() for
  first-run UX.
- audit.py: append-only JSONL audit log. AuditEvent with timestamp,
  user_id, role, action, target, outcome, reason, secondary_user_id
  for dual-auth, optional extra payload. Crypto signing of lines
  deferred to Sprint 8.

Studio GUI (arautopilot/studio/):

- app.py: real entry point (replaces Sprint 0 stub). --seed-demo
  populates demo users without launching GUI; --data-dir overrides the
  ~/.ar-autopilot/studio/ default.
- session.py: Session + SessionHolder. check() always audits the
  decision; verify_super_admin_pin() + log_dual_auth_grant() for
  dual-auth flows.
- login_window.py: modal login dialog with user picker + PIN field.
  Audits login attempts (success and bad-PIN denials).
- main_window.py: top-level window with sidebar (user + role + caps)
  and tab area (Overview, Flash Console, Project placeholder,
  Telemetry placeholder).
- flash_console.py: the "mini Arduino IDE". Lists serial ports via
  pyserial; picks firmware variant (esp32-dev / esp32-debug); compiles
  via 'pio run'; flashes via 'pio run -t upload --upload-port <port>';
  streams pio output to a dark-themed read-only console; supports
  cancel. For Engineer flashes, asks the Super Admin for their PIN
  inline before invoking pio. Records dual-auth grant + pio exit code
  in the audit log.

Dependencies:

- New [project.optional-dependencies] group 'studio': PySide6>=6.6,
  pyserial>=3.5, platformio>=6.1. Kept optional so the core can be
  installed in lean / CI environments.

Tests (arautopilot/tests/):

- test_rbac.py: 32 tests for capability matrix, dual-auth policy,
  no-privilege-escalation invariants, partial overlap between roles.
- test_user.py: 11 tests for PIN hashing, verification, salting,
  serialisation, field validators.
- test_audit.py: 9 tests for JSONL append, immutability, round-trip,
  corrupt-line detection, dual-auth event shape, blank-line tolerance.
- test_user_store.py: 10 tests for CRUD, persistence, role filtering,
  demo seed idempotency.
- test_session.py: 9 tests for capability checks + audit side effects,
  SA PIN verification, dual-auth recording, SessionHolder lifecycle.
- test_studio_smoke.py: 5 headless tests verifying Studio modules
  import without a display server, --seed-demo works, helpers safe to
  call without hardware.

NOT in Sprint 2.5 (intentional):
  - Crypto signing of audit log lines (hash-chain) -- Sprint 8
  - HWID binding of the user store -- Sprint 8
  - Project configurator + .appack compiler -- Sprint 4
  - Flutter bridge display -- Sprint 4
  - Telemetry dashboard tab -- Sprint 4
  - Serial monitor as a separate tab -- future enhancement

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

arautopilot/studio/main_window.py

@@ -1,4 +1,110 @@
-"""Studio main window — Sprint 4 stub.
+"""Studio main window (PySide6) -- Sprint 2.5.
 
-Reserved namespace for the PySide6 ``QMainWindow`` arriving in Sprint 4.
+Three areas:
+
+- Sidebar (left)   -- user + role + capabilities they hold.
+- Central tab area -- Flash Console (Sprint 2.5) + placeholders for the
+  project configurator that lands in Sprint 4.
+- Status bar       -- session info + audit log path.
 """
+
+from __future__ import annotations
+
+from PySide6.QtCore import Qt
+from PySide6.QtWidgets import (
+    QLabel,
+    QListWidget,
+    QMainWindow,
+    QSplitter,
+    QStatusBar,
+    QTabWidget,
+    QTextEdit,
+    QVBoxLayout,
+    QWidget,
+)
+
+from arautopilot.core.rbac import capabilities_of
+from arautopilot.studio.flash_console import FlashConsoleWidget
+from arautopilot.studio.session import Session
+from arautopilot.version import __version__
+
+
+class StudioMainWindow(QMainWindow):
+    """Top-level Studio window."""
+
+    def __init__(self, session: Session) -> None:
+        super().__init__()
+        self._session = session
+        self.setWindowTitle(
+            f"AR-Autopilot Studio v{__version__}  --  "
+            f"{session.user.display_name} ({session.role.value})"
+        )
+        self.resize(1100, 700)
+
+        splitter = QSplitter(Qt.Orientation.Horizontal)
+        splitter.addWidget(self._build_sidebar())
+        splitter.addWidget(self._build_central())
+        splitter.setStretchFactor(0, 0)
+        splitter.setStretchFactor(1, 1)
+        splitter.setSizes([260, 840])
+        self.setCentralWidget(splitter)
+
+        status = QStatusBar(self)
+        status.showMessage(f"Audit log: {session.audit.path}")
+        self.setStatusBar(status)
+
+    # ----- UI ------------------------------------------------------------
+    def _build_sidebar(self) -> QWidget:
+        w = QWidget()
+        layout = QVBoxLayout(w)
+        layout.setContentsMargins(8, 8, 8, 8)
+        layout.addWidget(QLabel(
+            f"<b>{self._session.user.display_name}</b><br/>"
+            f"<i>{self._session.role.value}</i>"
+        ))
+        layout.addWidget(QLabel("<b>Capabilities</b>"))
+        caps = QListWidget()
+        for cap in sorted(capabilities_of(self._session.role), key=lambda c: c.value):
+            caps.addItem(cap.value)
+        layout.addWidget(caps, stretch=1)
+        return w
+
+    def _build_central(self) -> QWidget:
+        tabs = QTabWidget()
+
+        tabs.addTab(self._build_overview_tab(), "Overview")
+        tabs.addTab(FlashConsoleWidget(self._session), "Flash Console")
+        tabs.addTab(self._placeholder_tab(
+            "Project configurator -- Sprint 4.\n\n"
+            "Will let you create / edit a per-vessel ProjectConfig and "
+            "compile it into an .appack for deployment."
+        ), "Project")
+        tabs.addTab(self._placeholder_tab(
+            "Telemetry -- Sprint 4.\n\n"
+            "Live Modbus telemetry from the connected AR-NMEA-IO board."
+        ), "Telemetry")
+        return tabs
+
+    def _build_overview_tab(self) -> QWidget:
+        w = QWidget()
+        layout = QVBoxLayout(w)
+        layout.addWidget(QLabel(
+            "<h2>AR-Autopilot Studio</h2>"
+            "<p>Welcome. Use the <b>Flash Console</b> tab to compile and "
+            "flash firmware to an AR-NMEA-IO board.</p>"
+            "<p>The <b>Project</b> tab (Sprint 4) will let you configure a "
+            "vessel and produce a deployable <code>.appack</code>.</p>"
+            "<p>Every action you take is recorded in the audit log "
+            "(see status bar at the bottom).</p>"
+        ))
+        layout.addStretch(1)
+        return w
+
+    def _placeholder_tab(self, text: str) -> QWidget:
+        w = QWidget()
+        layout = QVBoxLayout(w)
+        edit = QTextEdit()
+        edit.setReadOnly(True)
+        edit.setPlainText(text)
+        layout.addWidget(edit)
+        return w