Implement CoordinatorRoleGuard

Use a Riverpod Provider backed by a watchable auth state provider (already established in task-003). Keep CoordinatorRoleGuard a plain Dart class injected via Riverpod — do not make it a widget. The isCoordinator stream can be derived with StreamProvider.family or a select() on the auth state provider to avoid unnecessary rebuilds. For requireCoordinator(), prefer a synchronous read (ref.read) since it is called inside service/repository methods, not inside build().

Define InsufficientPermissionsException in a shared exceptions file to keep it reusable across guards. When wiring route guards, use GoRouter's redirect callback with a ref.read(coordinatorRoleGuardProvider).isCoordinatorSync getter to keep routing logic simple. Avoid duplicating the guard logic in the UI layer — the BLoC/service should throw and the UI should catch.

Unit tests using flutter_test with a ProviderContainer and mock auth state notifier. Test matrix: (1) user with coordinator role — requireCoordinator() does not throw, isCoordinator emits true; (2) user with peer_mentor role — requireCoordinator() throws InsufficientPermissionsException, isCoordinator emits false; (3) user with org_admin role — same as peer_mentor; (4) unauthenticated / null session — requireCoordinator() throws, isCoordinator emits false; (5) role change mid-session — isCoordinator stream emits correct new value. Route guard wiring covered by widget tests that attempt navigation to a coordinator-only route as a non-coordinator and assert redirect to no-access screen.