feat: add bump-version.sh script for version management

Automates version bumps across all version source files:
- Cargo.toml (PRIMARY - workspace.package.version)
- debian/changelog (prepend new entry)
- debian/control (update Version field)
- scripts/build-package.sh (update VERSION variable)
- frontend/package.json (update version field)
- Stale references check after bump

Usage: ./scripts/bump-version.sh <new_version> <old_version>

migrations/015_reporter_role.sql

@@ -0,0 +1,14 @@
+-- Migration 015: Add 'reporter' role to user_role enum
+-- Reporter is a read-only role for SSO auto-provisioned users.
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_enum e
+        JOIN pg_type t ON t.oid = e.enumtypid
+        WHERE t.typname = 'user_role' AND e.enumlabel = 'reporter'
+    ) THEN
+        ALTER TYPE user_role ADD VALUE 'reporter';
+    END IF;
+END
+$$;