Pixiportal

As an administrator, I want to assign applications to users and roles, so that access is granted according to business needs.

Acceptance Criteria:
Role-based assignment
The administrator can associate an application with one or more roles; any user holding that role gains access.

Direct assignment
The administrator can assign an application directly to a user, independent of their roles.

Duplicate assignment
Given an application is already assigned to a user (directly or through a role), the system prevents duplicate assignments, and the user sees the application only once in their catalog.

Combined access
A user has access to an application if granted through a role, direct assignment, or both.

Revocation
The administrator can remove an access grant (role-based or direct); the application immediately disappears from that user's catalog if no other access path remains.