Keep platform bootstrap permissions additive

modules/database/services/bootstrap_service.py

@@ -261,7 +261,12 @@ class BootstrapService:
         permissions = dict(BASE_PERMISSIONS)
         permissions["platform_admin"] = platform_admin
         permissions["platform_super_admin"] = super_admin
+        role_permissions = ROLE_PERMISSIONS.get(active.get("role") or "", {})
+        permissions.update(role_permissions)
         if platform_admin:
+            # Platform authority is additive and must not be reduced by a user's
+            # school membership role (for example a platform admin who also has
+            # a teacher/student membership).
             permissions.update({
                 "can_create_school": True,
                 "can_manage_school": True,
@@ -271,8 +276,6 @@ class BootstrapService:
                 "can_manage_classes": True,
                 "can_view_student_data": True,
             })
-        role_permissions = ROLE_PERMISSIONS.get(active.get("role") or "", {})
-        permissions.update(role_permissions)
         return permissions
 
     def _school_status(self, active: MembershipRow, memberships: List[MembershipRow], admin_profile: Optional[Dict[str, Any]]) -> str: