docs: say "membership tier" instead of the reserved word (ADR-0090 D3 ratchet)

The role-word ratchet caught this PR's own prose growing the count it exists
to shrink — in the docs for the change that closes the vocabulary, which is
about as pointed as a lint failure gets.

Every avoidable use is now "membership tier". What remains in the two touched
files is the better-auth boundary itself (`sys_member.role`, the wire field in
the invite sample), which D3 keeps as its documented exception.

authentication.mdx lands at 4, below its baseline of 5, so the baseline
ratchets down one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186LhwkUBupmLJUUAMda5hU

Author: claude

content/docs/permissions/authentication.mdx

@@ -684,7 +684,7 @@ an audit stamp (`granted_by`), a validity window, and a scope check that a tier
 never had.
 
 To invite someone straight into a position, put it in the invitation's
-*placement* rather than its role:
+*placement* rather than its membership tier:
 
 ```http
 POST /api/v1/auth/organization/invite-member
@@ -703,10 +703,10 @@ admins only. On acceptance the positions become real `sys_user_position` rows.
 
 <Callout type="warn">
 Earlier releases registered every declared position and permission-set name as
-a valid `role` value, so `{ "role": "sales_rep" }` was accepted. That path is
-removed: because every value stored in `sys_member.role` is projected into
-`current_user.positions`, it granted capability with none of the controls
-above. An invitation naming a position as its `role` is now refused with
+a valid membership tier, so naming one directly in the invitation was accepted.
+That path is removed: because every value stored in the tier column is
+projected into `current_user.positions`, it granted capability with none of the
+controls above. Naming a position as an invitation's tier is now refused with
 `ROLE_NOT_FOUND`. Use `positions` as shown.
 </Callout>
 

content/docs/permissions/positions.mdx

@@ -20,7 +20,7 @@ of their own** — they only decide *who gets which sets*.
 > `owner`, `admin`, `delegated_admin`, `member` and nothing else (ADR-0108). A
 > tier decides what you can *reach*; a position decides what you may *do*. To
 > invite someone straight into a position, use the invitation's `positions`
-> placement, not its role — see
+> placement, not its membership tier — see
 > [Authentication](/docs/permissions/authentication#membership-tiers-are-a-closed-list).
 
 ```typescript

scripts/role-word-baseline.json

@@ -13,7 +13,7 @@
   "content/docs/kernel/contracts/data-engine.mdx": 1,
   "content/docs/kernel/events.mdx": 1,
   "content/docs/kernel/services-checklist.mdx": 4,
-  "content/docs/permissions/authentication.mdx": 5,
+  "content/docs/permissions/authentication.mdx": 4,
   "content/docs/permissions/authorization.mdx": 3,
   "content/docs/permissions/delegated-administration.mdx": 11,
   "content/docs/permissions/index.mdx": 1,