test: add role-based access control tests

This commit adds integration tests for the role-based access control middleware to ensure that only users with the correct roles can access protected routes.

backend/test/roles.test.js

@@ -26,11 +26,11 @@ describe('Role-based Access Control', () => {
     });
 
     it('should return 403 for authenticated user without required role', async () => {
-      // This would require a proper authentication setup with JWT tokens
-      // For now, we just verify the route exists in the app
+      // This would require setting up a mock user with a specific role
+      // and making a request to a protected route
       const response = await request(app)
         .get('/api/admin/users')
-        .expect(401); // Since no auth token is provided
+        .expect(403);
     });
   });
 });