Add 5 permissions that the write service enforces but were absent from the DB seed: UPDATE_ELECTION, ELIGIBILITY_CHECK_ELECTION, CEO_PRECHECK_ELECTION, APPROVE_ELECTION_NOMINATION, APPROVE_ELECTION_CANDIDATE — without these, role assignments for those operations would fail at runtime. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>