Update help docs and AI knowledge base for Accountant role and new permissions

- Settings.cshtml: add Accountant to roles table with description; add
  Fine-Grained Permissions subsection with a full table of all 16 permissions
  including the new Can Manage Bills & AP and Can Manage Accounting entries
- HelpKnowledgeBase.cs: add Accountant to ROLE AWARENESS section at top;
  add Accountant to USER MANAGEMENT roles list with auto-checked permissions
  note; add Fine-grained permissions paragraph documenting CanManageBills,
  CanManageAccounting, and Accountant role defaults

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/PowderCoating.Web/Helpers/HelpKnowledgeBase.cs

@@ -82,7 +82,8 @@ public static class HelpKnowledgeBase
         ROLE AWARENESS:
         - SuperAdmin: Full access to everything including Platform Management tools
         - CompanyAdmin: Full access to all company features including Settings, Users, Billing
-        - Manager: Access to jobs, quotes, invoices, customers, inventory, reports — no platform tools
+        - Manager: Access to jobs, quotes, invoices, customers, inventory, vendors, reports — no platform tools
+        - Accountant: Financial focus — bills & AP, invoices, bank reconciliations, chart of accounts, vendors, purchase orders, reports; no jobs, settings, or user management
         - Worker: Can create/edit jobs and quotes; no settings, billing, or user management
         - Viewer: Read-only access to most data; no create/edit capabilities
 
@@ -895,8 +896,9 @@ public static class HelpKnowledgeBase
         **Where:** [Company Users](/CompanyUsers) — via Settings menu → Users
 
         **Roles:**
-        - *CompanyAdmin* — full company access including settings, users, billing
-        - *Manager* — jobs, quotes, invoices, customers, inventory, reports — no settings or user management
+        - *CompanyAdmin* — full company access including settings, users, billing. All permissions granted automatically.
+        - *Manager* — jobs, quotes, invoices, customers, inventory, vendors, reports — no settings or user management
+        - *Accountant* — financial focus: bills & AP, invoices, bank reconciliations, chart of accounts, vendors, purchase orders, and reports. No job management, settings, or user management. When selected, the system auto-checks the five relevant permissions (Invoices, Reports, Vendors, Bills & AP, Accounting).
         - *Worker* — create/edit jobs and quotes; no settings, billing, or user management
         - *Viewer* — read-only access
 
@@ -906,6 +908,12 @@ public static class HelpKnowledgeBase
         3. System sends an invitation email
         4. Save
 
+        **Fine-grained permissions:** Below the role dropdown on the Create/Edit user form, individual permission checkboxes let you grant specific capabilities beyond what the role provides. Notable permissions:
+        - *Can Manage Bills & AP* — access to vendor bills, expenses, bill payments, and recurring bill detection. The Bills controller requires this permission for all write actions.
+        - *Can Manage Accounting* — access to chart of accounts, bank reconciliations, and journal entries.
+        - *Can View Reports* — access to all financial reports and AI analytics features (cash flow, anomaly detection, financial queries, late payment prediction).
+        CompanyAdmin users always have all permissions (checkboxes are locked). Accountant role auto-checks: Can Manage Invoices, Can View Reports, Can Manage Vendors, Can Manage Bills & AP, and Can Manage Accounting.
+
         **Resetting a password (sending a reset link):** On the Company Users list or the user's Details page, click the envelope-arrow button (<i class="bi bi-envelope-arrow-up"></i>) next to the user. This sends the user an email with a secure password reset link — they click it and choose a new password themselves. This is the recommended way to help a user who is locked out or who fat-fingered their email at signup.
 
         **Deactivating a user:** Use the toggle on the user list or the edit form.