feat: Add role-based access control tests and template

backend/test/roles.test.js

@@ -25,9 +25,10 @@ describe('Role-based Access Control', () => {
         .expect(401);
     });
 
+    // Test that protected routes require correct role
     it('should return 403 for authenticated user without required role', async () => {
       // This would require setting up a mock user with a specific role
-      // and making a request to a protected route
+      // and making a request to a route that requires admin role
       const response = await request(app)
         .get('/api/admin/users')
         .expect(403);