docs: API.md + RBAC.md with Authentik integration

Documentation:
- docs/API.md: Complete API reference with examples
  - All endpoints with curl examples
  - Python SDK example
  - Error responses and rate limits

- docs/RBAC.md: RBAC system documentation
  - Two-level access control explained
  - Built-in roles (admin, portfolio-agent, authenticated-user)
  - Authentik configuration guide
  - Scope mapping examples for roles/permissions
  - Troubleshooting guide

JWT Integration:
- Add 'roles' field to JwtClaims struct
- Wire roles from Authentik JWT to RBAC Claims
- API key users get 'admin' role by default

Tests:
- Add test_to_rbac_claims_with_roles
- Verify roles extraction from JWT
- 670 tests passing

crates/mem-cli/src/jwt_validator.rs

@@ -17,6 +17,8 @@ pub struct JwtClaims {
     pub nbf: Option<i64>,
     pub permissions: Option<Vec<String>>,
     pub groups: Option<Vec<String>>,
+    /// Roles from Authentik (for RBAC)
+    pub roles: Option<Vec<String>>,
 }
 
 /// JWKS (JSON Web Key Set) response from Authentik