Adds verifyUserPassword (for current-password check before password change) and four global role methods (listRoleUsers, getRoleByName, assignGlobalRole, revokeGlobalRole) needed by the upcoming AccountService and VendorAdminService. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>