Add or update a tournament staff member

Grants a user the ADMIN or MODERATOR staff role on the tournament. Requires the tournaments staff capability and ADMIN authority - strictly higher than the MANAGER floor for reading the roster, so a tournament MODERATOR answers 403 and cannot promote themselves. Upserts by user: posting a role for someone who already holds a staff row updates that row instead of creating a second one, so this endpoint is safely retryable and also serves as the change-role operation. A MODERATOR gains the manager-floor endpoints (application review, participant removal and disqualification, free-agent pool moderation) but none of the admin-floor ones.