feat(izui): complete role-based migration (Phase 3-6)
Phase 3: All extension openers declare role explicitly
Phase 4: One-way session ratchet (transient→active, never back)
Phase 5: Remove izui-set-escape-mode self-declaration anti-pattern
Phase 6: Delete app/izui.js, all consumers use api.escape.onEscape() directly