fix: remove the unassignable Spaces administrator role

[igboyes]

Summary

• The role picker offered spaces, but assigning it 500s: Python's migration 997cf9a66f10 remapped those rows to base and added an administrator_role_valid CHECK permitting only full, settings, users and base. Dropped it from AdministratorRoleName, the level map, ADMINISTRATOR_ROLES and the request validator.
• That same migration dropped the administratorrole type, so the Drizzle mirror was describing a type Postgres no longer has. users.administrator_role is now text().$type<AdministratorRoleName>(), matching jobs.state.
• Fixed two comments citing deleted Python code, and dropped the Free Spaces line from the base role description to match Python's current docstring.

[linear-code]

VIR-2977

[sourcery-ai]

Hey - I've left some high level feedback:

• The allowed administrator role values are duplicated across the contracts type, Zod schema, ADMINISTRATOR_ROLES, and test fakes; consider centralizing them from a single source (e.g., the AdministratorRoleName union) to reduce the risk of future divergence.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The allowed administrator role values are duplicated across the contracts type, Zod schema, ADMINISTRATOR_ROLES, and test fakes; consider centralizing them from a single source (e.g., the AdministratorRoleName union) to reduce the risk of future divergence.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[igboyes]

Applied in 8b7e957: AdministratorRoleName is now derived from an ADMINISTRATOR_ROLE_NAMES tuple, which the request validator's z.enum consumes directly — same shape as PERMISSION_NAMES.

ADMINISTRATOR_ROLES stays a literal: it carries each role's display name and description, mirrored from the docstrings on Python's AdministratorRole enum, so there is nothing to derive them from. Its id is already typed AdministratorRoleName and data.test.ts pins the list. The test fake is a fixture and is meant to be an independent copy.