deploy.sh only synced the permission catalog; the system roles (admin, user)
were never seeded, leaving the admin Roles page empty after a fresh deploy.
Add app:seed-rbac (idempotent) to the deploy script, refresh the embedded
script in deployment-docker.md, document the RBAC post-deploy step (with the
manual fix for an already-deployed prod), and note it in CLAUDE.md.
Hold contact/address block edits in memory and persist them via explicit
saveContacts/saveAddresses on click (with saving guards), matching the task
forms. Keep immediate deletion. Minor restyle of blocks and action buttons.
Add ContractRelationDenormalizer to resolve IRIs for collections typed
against an interface (Contract), fixing POST/PATCH 400 errors. Cover it
with InterfaceCollectionDenormalizationTest.