Estate members

One approval here admits a person estate-wide — search on the front door, the library as a reader, the games shelf as a viewer. Revoking shuts every door within ten minutes. Rows are never deleted: a revoked person who comes back meets their revocation, not a fresh queue entry. Per catalog, visible is which shelves their search sees (the estate's fact); the role dropdowns are each app's own — the library's reader, the games shelf's viewer and the audiobook site's moderator/admin are different words on purpose, and changing one changes it in that app itself.