feat: harden query read-only workflow

frontend/src/features/rbac/README.md

@@ -0,0 +1,14 @@
+# RBAC Domain
+
+Scope:
+
+- users
+- roles and permissions
+- permission groups / instance groups
+- LDAP import and sync flows
+
+Migration targets:
+
+- Split `pages/UsersPage.tsx` into user list, user forms, password reset, LDAP import, and permission assignment components.
+- Keep permission constants and policy helpers here.
+- Keep generic modals and tables in `shared` only if reused outside RBAC.