Function is_leader 

pub fn is_leader(roles: &[Box<str>]) -> bool

True iff roles reaches the leader level — the bar for managing tenant-owned resources. The tenant owner carries the full hierarchy (build_tenant_owner_roles in auth-adapter-sqlite); federated visitors and share-link tokens carry none.